If you follow the news, you will often see that yet another company has been breached or taken hostage by ransomware. If you read the full details of these stories, usually they have one main thing in common: These organizations are behind in patch management. The question that arises, then, is why?

There are two sides to this story: A technical one and a procedural one. Let’s dive into the procedural side first. In general, patches — with the exception of emergency patches — can only be installed during a maintenance period. This is to ensure that business continuity is not interrupted. This brings the first issue forward: How do you determine what should be an emergency patch?

Following threat intelligence feeds can be a huge help here. If there is a rapidly emerging threat that can be prevented by installing an emergency patch, that is a valid justification to apply the emergency patch procedure.

Do You Know Your Mean Time to Patch?

If a patch is not considered to be an emergency patch, it is generally scheduled for the next maintenance period. According to various researchers, the average mean time to patch (MTTP) is between 60 and 150 days. There are many valid reasons for delaying the installation of a patch, which should be governed by a risk management process. However, is creating a monitoring use case in a security information and event management (SIEM) tool considered part of the risk acceptance criteria?

Patch Fatigue Is Widespread

Many IT departments are experiencing patch management fatigue. And there is a good reason for that. With the Common Vulnerabilities and Exposures (CVE) system being launched in 1999, we now have 20 years’ worth of publicly known vulnerabilities out in the open. If you analyze 20 years of vulnerabilities, the number of registered CVEs is increasing rapidly and thus the number of released patches is also increasing rapidly.

This is partly due to the success of bug bounty programs, but also because the industry is becoming more mature.

One solution to combat patch management fatigue is to deploy endpoint management software. However, most endpoint management solutions do not offer an answer for managing the installation of patches and updating hardware. And, quite a few of these hardware devices are typically located at the edges of the corporate network.

The Severity of Vulnerabilities Is Increasing

If you take a deeper look at the 20 years of CVEs, you will see that registered vulnerabilities are becoming more serious in nature, too.

This is largely due to the switch in calculation from CVSS-2 to CVSS-3. However, more importantly, criminals have also discovered that creating ransomware is a good source of income, and therefore, have increased efforts to breach corporate networks.

Attackers’ Focus Is Shifting

Partly because of the success of ransomware attacks, the focus on where vulnerabilities are discovered is also shifting. In the past, vulnerabilities were mainly discovered in applications. Nowadays, the focus is also on vulnerabilities in operating systems. This is in part also because many organizations have already deployed web application firewalls (WAFs) to protect their (web-enabled) business applications. Because of these developments, we can conclude that the focus for attacks has shifted from the server-side to the client-side.

Common attack vectors are drive-by attacks — where the user knowingly or unknowingly visits a malicious website — and phishing and spear phishing — where the user receives a targeted message with a URL link to a malicious website. Regarding the first attack vector, a filter proxy can provide additional protection. For the second attack vector, security awareness programs can increase protection. Technologies such as DNS analytics and user behavior analytics (UBA) can be used to fill the gap as well because they can generate early warnings of deviant behavior.

How to Measure Patch Management Success

So, how do you know whether your patch management program is successful or not? To answer this question, you should have the following key performance indicators (KPIs) available:

• Historical data on your mean time to patch
• Historical data on unpatched vulnerabilities
• Historical data on unpatched vulnerabilities that are covered by one or more monitoring use cases

From there, you should be able to meet the following conditions: Your average mean time to patch should not be bigger than the number of days between each maintenance period, and each unpatched vulnerability should be covered by one or more monitoring use cases. The number of unpatched vulnerabilities should not be bigger than the number of unpatched vulnerabilities that are covered by a monitoring use case.

Patch Management Has Become Essential

Patch management has been considered a necessary evil by IT, security and business teams for many years. However, with the recent shift in attack focus — from vulnerabilities in applications to vulnerabilities in operating systems — and the increase in publicized breaches and ransomware attacks, it is now essential for organizations to ensure they are properly managing vulnerabilities in their systems. If you’re meeting the above conditions and have a regular patch schedule that you stick to, you can rest easy knowing you’re on the right track.