How often should patch management be performed?

Blog

A patch is a small fix to an existing piece of software, usually used to fix bugs or security vulnerabilities. Patch Management is the process of handling all the patches of components within the company’s information system. It means that someone is doing just that – managing these patches.

Patch Management is most likely ignored among the security topics, but it is an important component of any security plan. Who can forget the ransomware attack WannaCry that infected hundreds of computers all over the world. One of the biggest reasons for the vulnerability was unpatched Windows machines.

Here are some more:

Source: testpreptraining.com

As IT infrastructure started moving to cloud, the risk of company’s infrastructure getting affected also went up. Thousands of patches are released everyday. But having a fix available and never applying it won’t help you. You need to implement patch management best practices and apply them to the right applications at the right time.

Here is the number of open source vulnerabilities by year:

Now, the question is how often?

If you don’t use an automated patch management solution like InfraGuard, the answer is rather complicated. Your response depends upon your organisation’s risk appetite, your organization’s compliance obligations as well as the vendor recommendations, systems resilience and/or notification period of outage to your customers, as well as availability of staff with appropriate skills to perform the patch and of course you need to test the patch first.

If you use an automated solution like InfraGuard here are some guidelines which makes it easier to create policies:

You must apply security patches in a timely manner. The time frame varies depending on system criticality, level of data being processed, vulnerability criticality, etc.
Security patches must be installed “immediately” using automated patching methods
Antivirus updates and scans must be run at least weekly
Other patches must be applied quarterly in accordance with the patch release cycle
If it is a Microsoft environment, then you would benefit most by installing patches monthly, scheduling this just after Patch Tuesday each month.

Apart from this patching it is best to run scheduled monthly vulnerability scans. Utilize InfraGuard’s vulnerability scanner by creating policies and scanning for vulnerability in your cloud, on-premises, and/or hybrid environment.

Once policies are in place it takes two clicks to Implement those policies via InfraGuard.