The National Cybersecurity Center of Excellence (NCCoE) has introduced the finalized versions of two Special Publications that offer guidance on business patch management practices to avoid taking advantage of vulnerabilities in IT solutions.
Cybercriminals and nation-state threat actors exploit unpatched vulnerabilities in software programs, operating systems, and firmware to acquire access to business networks to steal sensitive information and disturb operations. It’s important for all companies to make sure patches and software/firmware updates are applied immediately to avert exploitation.
NCCoE explained that patching is a crucial element of precautionary maintenance for computing systems -a cost of conducting business, and a required component of what companies need to do so as to realize their missions. It helps stop compromises, data breaches, operational interruptions, and other unfavorable incidents.
Although the significance of immediate patching is well known by IT, security, and technology management, the value and benefit of patching is usually less perceived by companies’ business and mission owners. In spite of vulnerabilities being frequently taken advantage of by threat actors, a lot of organizations either could not or don’t sufficiently patch. One of the major problems is the large number of patches and software/firmware upgrades that must be done and the time needed to completely check patches prior to deployment and implement those patches throughout the whole company. A lot of companies also have trouble with the prioritization of patching and don’t make sure that the most critical vulnerabilities get patched first.
NCCoE worked directly with cybersecurity technology companies to create guidance called Guide to Enterprise Patch Management Planning: Preventive Maintenance for Technology (SP-800-40) and Improving Enterprise Patching for General IT Systems: Utilizing Existing Tools and Performing Processes in Better Ways (SP-1800-31). Its goal is to help companies plan and implement patch management. The guidance documents go over the difficulties companies need to deal with when it comes to patch management and suggest a method that can be taken to simplify and operationalize patching to lower risks.
By adopting the patch management guidance, companies can ensure efficient preventive maintenance to minimize the threat of data breaches, interruption to business functions, and other negative security incidents.
