If you follow the news, you will often see that yet another company has been breached or taken hostage by ransomware. If you read the full details of these stories, usually they have one main thing in common: These organizations are behind in patch management. The question that arises, then, is why?

There are two sides to this story: A technical one and a procedural one. Let’s dive into the procedural side first. In general, patches — with the exception of emergency patches — can only be installed during a maintenance period. This is to ensure that business continuity is not interrupted. This brings the first issue forward: How do you determine what should be an emergency patch?

Following threat intelligence feeds can be a huge help here. If there is a rapidly emerging threat that can be prevented by installing an emergency patch, that is a valid justification to apply the emergency patch procedure.

Do You Know Your Mean Time to Patch?

If a patch is not considered to be an emergency patch, it is generally scheduled for the next maintenance period. According to various researchers, the average mean time to patch (MTTP) is between 60 and 150 days. There are many valid reasons for delaying the installation of a patch, which should be governed by a risk management process. However, is creating a monitoring use case in a security information and event management (SIEM) tool considered part of the risk acceptance criteria?

Patch Fatigue Is Widespread

Many IT departments are experiencing patch management fatigue. And there is a good reason for that. With the Common Vulnerabilities and Exposures (CVE) system being launched in 1999, we now have 20 years’ worth of publicly known vulnerabilities out in the open. If you analyze 20 years of vulnerabilities, the number of registered CVEs is increasing rapidly and thus the number of released patches is also increasing rapidly.

This is partly due to the success of bug bounty programs, but also because the industry is becoming more mature.

One solution to combat patch management fatigue is to deploy endpoint management software. However, most endpoint management solutions do not offer an answer for managing the installation of patches and updating hardware. And, quite a few of these hardware devices are typically located at the edges of the corporate network.

The Severity of Vulnerabilities Is Increasing

If you take a deeper look at the 20 years of CVEs, you will see that registered vulnerabilities are becoming more serious in nature, too.

This is largely due to the switch in calculation from CVSS-2 to CVSS-3. However, more importantly, criminals have also discovered that creating ransomware is a good source of income, and therefore, have increased efforts to breach corporate networks.

Attackers’ Focus Is Shifting

Partly because of the success of ransomware attacks, the focus on where vulnerabilities are discovered is also shifting. In the past, vulnerabilities were mainly discovered in applications. Nowadays, the focus is also on vulnerabilities in operating systems. This is in part also because many organizations have already deployed web application firewalls (WAFs) to protect their (web-enabled) business applications. Because of these developments, we can conclude that the focus for attacks has shifted from the server-side to the client-side.

Common attack vectors are drive-by attacks — where the user knowingly or unknowingly visits a malicious website — and phishing and spear phishing — where the user receives a targeted message with a URL link to a malicious website. Regarding the first attack vector, a filter proxy can provide additional protection. For the second attack vector, security awareness programs can increase protection. Technologies such as DNS analytics and user behavior analytics (UBA) can be used to fill the gap as well because they can generate early warnings of deviant behavior.

How to Measure Patch Management Success

So, how do you know whether your patch management program is successful or not? To answer this question, you should have the following key performance indicators (KPIs) available:

  • Historical data on your mean time to patch
  • Historical data on unpatched vulnerabilities
  • Historical data on unpatched vulnerabilities that are covered by one or more monitoring use cases

From there, you should be able to meet the following conditions: Your average mean time to patch should not be bigger than the number of days between each maintenance period, and each unpatched vulnerability should be covered by one or more monitoring use cases. The number of unpatched vulnerabilities should not be bigger than the number of unpatched vulnerabilities that are covered by a monitoring use case.

Patch Management Has Become Essential

Patch management has been considered a necessary evil by IT, security and business teams for many years. However, with the recent shift in attack focus — from vulnerabilities in applications to vulnerabilities in operating systems — and the increase in publicized breaches and ransomware attacks, it is now essential for organizations to ensure they are properly managing vulnerabilities in their systems. If you’re meeting the above conditions and have a regular patch schedule that you stick to, you can rest easy knowing you’re on the right track.

More from Endpoint

The Evolution of Antivirus Software to Face Modern Threats

Over the years, endpoint security has evolved from primitive antivirus software to more sophisticated next-generation platforms employing advanced technology and better endpoint detection and response.  Because of the increased threat that modern cyberattacks pose, experts are exploring more elegant ways of keeping data safe from threats.Signature-Based Antivirus SoftwareSignature-based detection is the use of footprints to identify malware. All programs, applications, software and files have a digital footprint. Buried within their code, these digital footprints or signatures are unique to the respective…

Contain Breaches and Gain Visibility With Microsegmentation

Organizations must grapple with challenges from various market forces. Digital transformation, cloud adoption, hybrid work environments and geopolitical and economic challenges all have a part to play. These forces have especially manifested in more significant security threats to expanding IT attack surfaces. Breach containment is essential, and zero trust security principles can be applied to curtail attacks across IT environments, minimizing business disruption proactively. Microsegmentation has emerged as a viable solution through its continuous visualization of workload and device communications…

Self-Checkout This Discord C2

This post was made possible through the contributions of James Kainth, Joseph Lozowski, and Philip Pedersen. In November 2022, during an incident investigation involving a self-checkout point-of-sale (POS) system in Europe, IBM Security X-Force identified a novel technique employed by an attacker to introduce a command and control (C2) channel built upon Discord channel messages. Discord is a chat, voice, and video service enabling users to join and create communities associated with their interests. While Discord and its related software…

3 Reasons to Make EDR Part of Your Incident Response Plan

As threat actors grow in number, the frequency of attacks witnessed globally will continue to rise exponentially. The numerous cases headlining the news today demonstrate that no organization is immune from the risks of a breach. What is an Incident Response Plan? Incident response (IR) refers to an organization’s approach, processes and technologies to detect and respond to cyber breaches. An IR plan specifies how cyberattacks should be identified, contained and remediated. It enables organizations to act quickly and effectively…