You’ve read news articles about the latest “zero-day” exploits spreading across the web. These exploits are great news fodder, but zero-day attacks aren’t the most dangerous enemy to your organization. Patches are.c
What does your patch management process look like? Do you have one?
A patch is a small fix to an existing piece of software, usually used to fix bugs or security vulnerabilities. But having a fix available and never applying it won’t help you. You need to implement patch management best practices and apply them to the right applications at the right time.
You’ll need to patch operating systems for your servers and endpoint devices. Don’t forget that patches need to be applied to vendor products integrated into your environment, not to mention patching your own software is another key piece of the puzzle.
Before we discuss how to create your own patch management process, let’s look at why it’s so important.
Why Is Patch Management Important?
When patches are released to the public, the vulnerability often is disclosed with it. If you were an attacker, would you spend weeks or months trying to find a vulnerability, or read up on the latest patch for a third party component and bet on the fact that most users are not fast enough to apply them?
If you take into consideration the fact that only 10% of the code base in an average application is written in house and that 21,000 known vulnerabilities (CVEs) were reported in the last 18 months, you’ll understand that known vulnerabilities have become the weakest link in your software security.
Patches require time and effort to apply. Annually, organizations spend 18,000 hours and over a million dollars on patching activities. Despite this effort, many have seen (Read more...)
*** This is a Security Bloggers Network syndicated blog from Blog – WhiteSource authored by Patricia Johnson. Read the original post at: https://resources.whitesourcesoftware.com/blog-whitesource/patch-management-best-practices