NexusSec.Most businesses intend to patch. The ones that actually do have a routine: a date in the calendar, a list of what is covered, and someone whose job it is. Without that, patches wait for a quiet week that never comes.
Start with a list
You cannot patch what you do not know you have. Keep a simple inventory: computers, servers, firewalls, switches, access points, NAS devices, printers, phones and the main applications, with the version each runs and who looks after it. It does not need a product; a maintained spreadsheet is far better than nothing.
What goes first
- Internet-facing systems: firewalls, VPN gateways, email servers, websites and remote-access tools. They are reachable by anyone, so a published flaw in them is urgent. See what the internet can see.
- Vulnerabilities known to be exploited. CISA's Known Exploited Vulnerabilities catalog lists flaws seen used in real attacks, and CERT-In publishes advisories for India. If something you run appears in either, it moves to the front.
- Everything else, on the regular monthly cycle.
A monthly rhythm
- Week of release. Microsoft publishes its regular security updates on the second Tuesday of each month, and many other vendors follow a predictable schedule. Review what was released and what applies to you.
- Pilot group, then everyone. Apply updates to a small group of machines that represents your setup, including IT's own, wait a few days, then roll out to everyone.
- Servers in a maintenance window, with a backup taken first and a known way back.
- Network devices in their own window. Firewalls and switches need a planned outage and a configuration backup before the update.
Do not forget firmware
Windows and Office updates are mostly automatic now. The gaps are elsewhere: firewalls, switches, access points, NAS boxes, camera recorders and printers rarely update themselves, and they are often the devices attackers target. Put each one on the list with its current version, and check for new firmware every month.
Plan for things going wrong
- Know how to roll back each kind of update before you apply it.
- Back up configurations and take snapshots of virtual servers before patching them. See backups that survive ransomware.
- Tell the business when the maintenance windows are, so a restart is not a surprise.
Exceptions and end of life
Sometimes a system cannot be patched: an old application that breaks, a machine controller supported only on an old operating system. Record each exception, why it exists, who accepted the risk and until when, and protect the system another way, for example by putting it in its own network zone. Systems that no longer receive security updates at all should be planned out, starting with anything internet-facing. A firewall at end of support is a common example; see before you sign the firewall renewal.
If you would rather hand this over, our patch management service runs the routine for you in agreed windows.
