A patch is a correction for software. It closes security vulnerabilities, fixes bugs, or adds new features. Patch management ensures that these updates reach all systems not at random, but in a regulated and traceable way. This is one of the most fundamental IT security measures, because many attacks exploit known vulnerabilities for which an update would already be available.
How does patch management work?
A typical process comprises five steps:
- Overview: Which systems, operating systems, and applications exist, and which versions are they running?
- Assessment: New updates are reviewed and classified by urgency. Security-critical updates are given priority.
- Testing: Updates are first rolled out to a small group of test systems or pilot users.
- Distribution: This is followed by gradual distribution to all systems, often in fixed maintenance windows.
- Monitoring: Reports show where updates have failed or are still pending.
Microsoft usually releases regular security updates for Windows and Office on the second Tuesday of each month, the so-called Patch Tuesday. Other vendors have their own cycles, and critical vulnerabilities are often closed outside the regular schedule as well.
In addition, there are questions of ongoing operations: restarts must be planned, employees informed, and devices reached that are rarely on the corporate network, such as laptops in field service. Modern management tools therefore distribute updates directly via the internet.
Typical examples
- Monthly Windows updates for workstations, controlled via central management such as Microsoft Intune.
- Updates for third-party software such as browsers, PDF programs, or video conferencing clients.
- Firmware updates for firewalls, switches, printers, and storage systems.
- An emergency update for an internet-facing server after an actively exploited vulnerability has become known.
What companies should keep in mind
- Include not only operating systems but also applications and network devices.
- Set deadlines according to criticality and provide an accelerated process for emergencies.
- Create backups before larger updates so that you can roll back in case of problems, see Backup and Recovery.
- Identify systems without vendor support and replace them or isolate them from the rest of the network.
- Align patch management with vulnerability management so that priorities are based on real risks.
How it differs
Vulnerability management finds and assesses security vulnerabilities; patch management is the most important way to close them. However, not every vulnerability can be fixed by an update; some require configuration changes.
How TOMORIS relates
In TOMORIS connected IT operations, the GRID.patch module handles update management.
View GRID.patch