Patch management for small business: security updates

Many intrusions exploit a known vulnerability for which a patch already existed. Security updates are therefore a basic protection, but they do not apply themselves: computers, servers, firewalls, applications and firmware each have their own update channel and their own pace.

Patch management organizes this work: knowing what needs updating, within what timeframe, after which test, and checking that it is done. It is also a topic that cyber insurance questionnaires regularly cover.

What needs to be updated?

Everything starts with an up-to-date inventory of hardware and software. Equipment that no longer receives patches, because its manufacturer has stopped maintaining it, is identified, then replaced or isolated.

• Computers: the Windows or macOS operating system, drivers and browsers.
• Servers, physical or virtual, including the hypervisor.
• The firewall, the VPN gateway and Wi-Fi access points, often forgotten even though they are exposed.
• Third-party applications: PDF readers, video conferencing tools, business software, runtimes such as Java.
• Firmware: computer BIOS, switches, NAS devices, printers.
• Smartphones that access company e-mail.

How quickly should a security patch be applied?

Not all patches are equally urgent. Microsoft releases its monthly patches on the second Tuesday of the month; other vendors follow their own schedule or release emergency fixes. The timeframe depends on the severity of the vulnerability, how exposed the equipment is and whether the flaw is already being exploited.

An actively exploited vulnerability on equipment exposed to the internet, such as a firewall or a VPN, is fixed within the following days, sometimes the same day. Routine patches for computers follow the monthly cycle, with a pass through a pilot group.

Testing security updates without delaying everything

A patch can break a business application, a printer driver or a VPN connection. Rather than testing every update in detail, deploy it first to a pilot group: a few representative computers, used by people who know how to report a problem. If there are no issues after a few days, the rollout extends to everyone.

For servers, a verified backup or a snapshot taken just before the update makes it possible to roll back. Do not keep the snapshot longer than necessary: it is not a backup.

Restarts: how do you patch without disrupting teams?

• A clear deadline: the computer restarts on its own if the user has postponed for too long.
• Notifications that announce the restart in advance.
• Servers updated in an agreed maintenance window, outside working hours.
• Network equipment updated with someone available to check that it comes back up.

Tracking and proving that it is done

The work is only finished once it has been verified. A regular report shows the share of computers that are up to date, those that have not connected for a long time and failed installations. This tracking also serves as evidence for an insurer or a client who asks the question.

When security maintenance is part of the fleet management contract, SysPros schedules updates for the computers, servers and network equipment it looks after, and flags systems that no longer receive patches. Updates that require specific manual work, a migration or a major version change are proposed separately.