Malware exists to exploit vulnerabilities discovered in software. Patches exist to fix those vulnerabilities. So why do so many vulnerabilities remain unpatched? Why is patch management so complicated?

Sadly, security and IT professionals don’t live in a patch-everything-right-away fantasy land. Trade-offs and compromises are dictated by the conflicting priorities and interests within large organizations.

And people are people. Humans have cognitive biases that cause them to behave irrationally. The most dangerous of these biases is called hyperbolic discounting. People tend to choose smaller rewards now over larger rewards later. When offered a choice between avoiding patch-related headaches now and avoiding cyberattack-related headaches later, most people are drawn to the former. Bolstering this irrational choice is the false idea that “maybe we’ll get lucky and nobody will attack us.”

Not all patches are created equal. Some are urgent, others are not. Some require rebooting, others do not. Some can jam third-party applications, others cannot. The vagaries of complex systems and organizations, compounded by the irrationality of the human mind and variations in patches themselves, means that patch management is not an exact science — it’s an art.

Why Patch Management Is Indispensable

Patch management is an umbrella term for the process of knowing about, acquiring, testing, installing and following up on patches.

According to Accenture, cybercrime could cost businesses $5.2 trillion over the next five years. How much of that cost could be prevented by the massively lower cost of good patch management? Expert estimates on the number of new vulnerabilities revealed in 2018 ranged from 16,555 to 22,022. The exact number doesn’t matter; it’s a big number.

Patch management is necessary because of the sheer number and complexity of systems to be patched, variations in the patches themselves and the complexity of orchestrating downtime in big organizations full of divergent priorities.

Organizations often proceed with the false idea that security issues precede patches. In fact, it’s the reporting and patching of a vulnerability that often gives cybercriminals the information they need to create an exploit. WannaCry, for example, was created after the vulnerability it exploited had been “fixed” with a patch. (The patch only “fixes” if you deploy it.) Threat actors know that a huge percentage of organizations won’t patch in a timely manner, and that’s their window.

In other words, the availability of a patch makes security better for those who deploy the patch and worse for those who don’t.

The Myriad Challenges of Patch Management

Shockingly, just 27 percent of cybersecurity teams surveyed in a recent white paper from IDC and SolarWinds said that patch management is a strategy for defending against cyberattacks. And, according to Verizon, around 56 percent of reported vulnerabilities are not patched within 90 days of disclosure. What’s more, just 42 percent of small and midsize organizations automate or even have plans to automate patch management, according to a survey from Kaseya.

Why aren’t organizations patching everything? And why aren’t they automating?

I think the reason can be summarized as “patch fatigue.” There are simply so many patches to process. Microsoft has released more than 10,000 patches this year alone.

Then there’s the technical debt problem: IT has to make sure that applying a patch to one system won’t break another. Patch testing impacts the time, schedules and objectives of application owners and business users.

On the Art of Patch Management

Patch management is an art form because it requires prioritization, quality vulnerability assessment, soft people skills, creative thinking, awareness of the latest threats and even intuition born of experience. Here are some of the key elements of the art of patch management:

• First thing’s first: Patching everything with the perfect procedures on the perfect schedule is unlikely, unless you have unlimited staff and budget. Thoughtful prioritization is a big part of the art of patch management. Prioritize the systems and functions that are most vital to your organization’s business and those that would cause the greatest harm in the event of an attack. An advanced vulnerability assessment tool or service can help you discover where the most threatening vulnerabilities are hiding.
• Don’t exclude the people factor. Business users can have a bigger fear of patch-related downtime than the existential threat of catastrophe resulting from unpatched systems. For this challenge, culture is key. Never stop working on building a culture of perspective and collective ownership when it comes to mitigating security risk.
• Next, clearly agree on who does what with clear rules of ownership. Communicate service-level agreements (SLAs) and responsibilities. Right-size ownership for your organization, but be clear and communicate.
• You also need to sweat the small stuff. It’s tempting to focus on servers and workstations, but don’t forget about internet of things (IoT) devices such as office equipment (e.g., printers), security equipment (e.g., cameras) and network devices (e.g., network-attached storage). You still have to focus on legacy systems. Cloud resources need to be patched, too. Think of every system in the organization in terms of patchable elements — for example, think of a server as many patchable things: firmware, OS and every application installed.
• Communicate needs and foster an environment of collaboration among teams. Track and record the effectiveness of patch management and use that information to communicate risk mitigation so everyone understands why it’s worth the time and money.
• Another crucial piece of effective patch management is a simple and consolidated approach. Automate as much as you can, but don’t expect to automate everything. Find the best patch management solutions, which will help you keep a database of the hardware, software and middleware updates that are available. These will either update automatically or alert users that they need to be implemented manually. Crucially, a solution should alert admins about all unpatched software in the organization. Minimize the number of tools you’re using, investing in a smaller number of solutions that each do more patch management tasks across the greatest number of platforms.
• Be mindful of unintended consequences. You’ll need to keep a handle not only on existing software vulnerabilities, but also vulnerabilities resulting from software dependencies.
• Always pay attention to timing. For example, never update firmware and software at the same time. And don’t forget: You’re a business. Patching and rebooting needs to be compatible with user and department schedules, and therefore needs to be carefully timed or scheduled.
• Watch out for the risks that arise from the mitigation of risks. Patches need to be tested beforehand, and even patches that pass testing need the insurance policy of having a roll-back plan in place in case things go awry.
• Finally, remember to keep your patch management tools themselves up to date.

Yes, patch management is an art. And you’re the artist. Start implementing the key steps above to turn your patch management system into a masterpiece.