Security Patch Management

Security patch management is the organised process of applying software fixes that correct security weaknesses. It involves identifying, prioritising, acquiring, installing and verifying security patches across operating systems, applications and device firmware, thereby reducing exposure to known vulnerabilities.

How patching reduces exposure

A vulnerability is a weakness in software; an exploit is a method or code that takes advantage of that weakness. A security patch changes the affected software to correct a vulnerability, blocking attacks that depend on that particular flaw.

• Timely patching shortens the window of exposure, meaning the period during which a system remains vulnerable before an effective fix is installed.
• Patching internet-facing services and other exposed systems reduces opportunities for initial compromise; patching internal systems can also hinder attackers from gaining higher privileges or moving between systems.
• Regular patching is preventive maintenance, rather than a measure to begin only after an attack.

The patch management cycle

Effective patching requires a repeatable process, not simply downloading updates whenever convenient.

• Maintain an asset inventory recording software, versions and dependencies so that affected systems can be identified.
• Monitor vendor advisories and vulnerability information to identify available fixes and systems requiring attention.
• Use risk-based prioritisation: consider active exploitation, system exposure, vulnerability severity and the importance of the affected service.
• Obtain patches from trusted sources and test compatibility before deployment, especially where failure could disrupt essential services.
• Deploy patches through a controlled process, with backups and recovery arrangements appropriate to operational risks.
• Verify successful installation and remediation, and track failed installations, exceptions and remaining unpatched systems.

Limits and safeguards for critical infrastructure

Patch management is part of defence in depth, not a complete security solution. It does not eliminate undiscovered vulnerabilities, and installing a patch does not by itself remove an attacker already present.

• Where immediate patching is unsafe or unavailable, compensating controls, such as network segmentation, restricted access and disabling vulnerable services, can reduce exposure without correcting the underlying flaw.
• Critical infrastructure requires careful testing and planned maintenance because poorly managed changes can interrupt essential operations.
• Unsupported software should be replaced or upgraded because continuing access to security fixes cannot be assumed.