Software and Hardware Updates and Patching

What it is

Updates replace old code with fixed code, so that known weaknesses can no longer be used against you.

A patch is a small update that fixes a specific problem, often a security flaw. When a flaw is made public, attackers quickly write exploits for it, so devices that are not updated become easy targets.

This page covers four kinds of update and the process that keeps patching safe and regular.

How it works

Every layer of a device needs updates, from the firmware up to the applications.

The layers that need updates

Firmware is easy to forget, because it has no obvious update button. Network devices, printers and IoT devices often run old firmware for years, and attackers know it.

Drivers run with high privileges. A flawed driver can give an attacker deep access, so drivers should come from the hardware maker or the operating system vendor.

Windows Update and other tools

Windows Update is the built in service that downloads and installs updates for Windows and many Microsoft products. Microsoft releases its regular security updates on the second Tuesday of each month. Larger organisations control this with a central management tool, so that updates are tested first.

On Linux, a package manager handles updates for the system and its software.

$ sudo apt update
$ sudo apt upgrade

This example is for Debian and Ubuntu based systems. apt update refreshes the list of available packages, and apt upgrade installs the newer versions. Other Linux families use different package managers.

Application updates are often forgotten, even though web browsers, document readers and plug ins are common targets. Many applications can update themselves, and a managed tool can also push them.

The patching process

A safe process has clear steps:

1. Identify which systems and software are in use, using the inventory.
2. Assess new patches and rank them by risk, with serious flaws first.
3. Test patches on a small group of non critical systems.
4. Deploy to the rest, ideally in stages and in a maintenance window.
5. Verify that the patch installed and that systems still work.
6. Roll back if the patch causes problems, and record what happened.

Patching too slowly leaves a window for attack. Patching without testing can break important systems. A good balance is a regular schedule, with an emergency route for serious flaws that are already being attacked.

A zero day is a flaw that attackers use before a patch exists. When no patch is ready, other controls such as network segmentation, firewalls and monitoring help to reduce the risk until it is fixed.

Why it is not always simple

Some systems cannot be updated easily. Old equipment may no longer get updates, and a few special devices must not be restarted.

For these, use compensating controls, such as placing them in a separate network segment with strict rules. The best long term answer is to replace unsupported equipment.