Patch Management.

What is patch management?

A patch is a software change that fixes a problem, often a security flaw. Patch management is the work of handling those changes across an organization. NIST SP 800-40 says enterprise patch management is the process of identifying, prioritizing, acquiring, installing, and verifying the installation of patches, updates, and upgrades throughout an organization.

How does the patching process work?

The NIST definition lists the steps. First, an organization identifies which patches apply to its systems. Next, it prioritizes them, because not every patch is equally urgent. Then it acquires and installs them. Last, it verifies that the installation worked.

A simple illustration: a team learns that a program it uses has a security fix. It checks which computers run that program, decides how urgent the fix is, installs it, and then confirms the fix is in place.

Why does patch management matter?

NIST says preventive maintenance through enterprise patch management helps prevent compromises, data breaches, operational disruptions, and other adverse events. It also says patching is more important than ever because of the increasing reliance on technology.

NIST notes that there is often a divide between business or mission owners and security or technology managers about the value of patching. It describes patching as a cost of doing business and a necessary part of what organizations need to do to achieve their missions. It recommends creating an enterprise strategy to simplify and operationalize patching while also improving the reduction of risk.

How can teams decide what to patch first?

CISA keeps a catalog of known exploited vulnerabilities. A vulnerability is a weakness in software or hardware that an attacker can abuse. CISA describes this catalog as the authoritative source of vulnerabilities that have been exploited in the wild. It says organizations should use it as an input to their vulnerability management prioritization framework.

CISA also directs stakeholders to apply mitigations in accordance with vendor instructions. A vendor is the company that makes the product. For products where mitigations are unavailable, CISA recommends that stakeholders discontinue use of the product. CISA also says organizations are responsible for evaluating each asset’s internet exposure.

How does patch management relate to nearby terms?

Patch management is one part of vulnerability management, which covers finding and ranking weaknesses more broadly. A zero-day vulnerability is a flaw that is known before a fix exists, so related terms are listed below for further reading.

Is patch management the same as vulnerability management?

No. Vulnerability management is the wider practice of finding and prioritizing weaknesses. Patch management is the process of getting fixes onto systems and checking that they are in place.

Is a patch the same as an update?

The NIST definition names patches, updates, and upgrades as separate items that the process covers. In everyday use, people often say patch for a fix and update for a newer version.