7 Examples of Patch Management

John Spacey, October 06, 2018

Patch management is the process of applying fixes and upgrades to software. This is critical to information security because security vulnerabilities are often widely known and exploited by the time that a patch is available from a software vendor. As such, staying on top of patches is a foundational activity for any information technology environment. The following are common examples of patch management.

Vulnerability Monitoring

Monitoring current vulnerabilities and threats to your software environment and pushing vendors for patches. Alternatively, many firms have no idea that a vulnerability exists until a vendor notifies them of a patch. In the worst case, a firm is oblivious to vulnerabilities or patches until they have a problem or hear about a problem in the media.

Patch Analysis

Evaluating a patch to identify and manage risks. In many cases, vendors bundle new features with a patch that may have business impacts. Some security patches are rushed out the door such that they contain bugs or vulnerabilities. It is also possible for a "patch" to completely rearchitect a product such that it has widespread implications for the performance, functions and customizations of software.

Patch Planning

Developing a plan to implement the patch. This may address complex dependencies. For example, if you upgrade firmware you may need to upgrade an operating system which may lead to a need to update applications and so forth. In many cases, you will need to confirm with vendors that their software will be compatible with a patch.

Change Management

The process of deciding whether to implement a patch and if so when it should be implemented. This may involve stakeholders such as business units, customers and technology teams. For example, it is possible for a patch implementation to require downtime that impacts all customers.

Testing

Applying a patch to test environments and running regression tests, user acceptance tests, performance tests and security tests. Deployment procedures are also tested including procedures for rollback.

Deployment

Deploying a patch to critical environments such as production. In many cases, patches are both developed quickly and deployed quickly such that they have an unusually high risk of failing. As such, rollbacks are common.