Chapter 5 — Patch and vulnerability management
Lesson map
Lesson 05 published. Map, example, EX021.
flowchart TD
N0["Learning outcomes"]
N1["5.1 Measuring compliance"]
N2["5.2 The patch lab"]
N3["Lab — Critical patch compliance per clinic on synthe"]
N4["5.3 Causes and support"]
N5["5.4 Constrained systems"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5
N5 --> EX["Worked example"]
EX --> Q["Exercise EX021"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["5.1 Measuring compliance"]
N2["5.2 The patch lab"]
N3["Lab — Critical patch compliance per clinic on synthe"]
N4["5.3 Causes and support"]
N5["5.4 Constrained systems"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX021"]
[Learning outcomes]
|
v
[5.1 Measuring compliance]
|
v
[5.2 The patch lab]
|
v
[Lab — Critical patch compliance per clinic on synthe]
|
v
[5.3 Causes and support]
|
v
[5.4 Constrained systems]
|
v
[Worked example] --> [Exercise EX021]
Learning outcomes
You will (1) measure patch compliance across sites; (2) find sites that need support; (3) design remediation for constrained systems.
5.1 Measuring compliance
Elena defines her measure: the share of devices with critical security updates installed within fourteen days of release, by clinic. She extracts synthetic data from the device management system. Dr. Qureshi asks her to report both the overall figure and the spread between clinics, because a good average can hide clinics with serious gaps, and attackers need only one weak point to enter a connected network. She writes the definition in the measure handbook with the data source, the owner and the reporting frequency, so the same figure can be produced each month.
5.2 The patch lab
The lab covers 566 synthetic devices across twenty-two clinics. Overall, 513 devices, 90.6 percent, received critical updates within fourteen days. The three lowest clinics are C19 with 10 of 20 devices, 50.0 percent; C15 with 20 of 28, 71.4 percent; and C07 with 22 of 30, 73.3 percent. All three are the clinics relying on a part-time local IT contact. Elena notes that the overall figure would have hidden these clinics completely. She presents the clinic-level results to the security committee with a short chart, and the committee agrees that the three clinics should receive extra support immediately rather than waiting for the next quarterly review.
Lab — Critical patch compliance per clinic on synthetic device data
"""Critical patch compliance per clinic on synthetic device data (stdlib only)."""
import random
random.seed(14)
rows = []
for c in range(1, 23):
late_p = 0.06 if c not in (7, 15, 19) else 0.30 # three clinics with a part-time IT contact
for d in range(random.randint(20, 34)):
rows.append((f"C{c:02d}", random.random() >= late_p))
by = {}
for clinic, ok in rows:
t = by.setdefault(clinic, [0, 0]); t[0] += ok; t[1] += 1
total_ok = sum(ok for _, ok in rows)
print(f"devices {len(rows)}; patched within 14 days {total_ok} ({total_ok/len(rows):.1%})")
worst = sorted(by.items(), key=lambda kv: kv[1][0] / kv[1][1])[:3]
for c, (ok, n) in worst:
print(f"{c}: {ok}/{n} ({ok/n:.1%})")
Run with python3 lab_patch.py. Verified output:
devices 566; patched within 14 days 513 (90.6%)
C19: 10/20 (50.0%)
C15: 20/28 (71.4%)
C07: 22/30 (73.3%)
5.3 Causes and support
Elena visits the three clinics. Devices are often switched off overnight, when updates are scheduled, and the part-time contacts lack time to chase them. She changes update scheduling to lunchtime with automatic restarts outside appointments and asks the device management system to alert her when a device misses two cycles. She also arranges a monthly remote check by the central team. Dr. Qureshi notes that the fix addresses causes rather than blaming local staff. After two months, all three clinics exceed ninety percent.
5.4 Constrained systems
Imaging computers cannot always receive operating system updates because suppliers restrict them. Elena isolates them on a separate network segment, blocks internet access except to the supplier's update service and restricts which devices can connect to them. She records each as an exception with an expiry date and a request to the supplier for a supported version. She learns that when patching is impossible, reducing exposure is the next best control. The supplier promises a supported version within the year, and Elena tracks the commitment in the risk register.
Worked example
Elena measures 90.6 percent compliance overall, finds three clinics at 50.0 to 73.3 percent, fixes scheduling causes and isolates unpatchable imaging computers.
Synthetic case. Devices are synthetic; outputs come from lab_patch.py.
Errors and limits
An overall compliance figure can hide clinics with serious gaps.
Exercises
- EX021 — Overall compliance. What is overall patch compliance? Rubric: 3 = 513 of 566, 90.6 percent;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX022 — Lowest clinic. Which clinic is lowest? Rubric: 3 = C19 at 50.0 percent;; 2 = partly correct;; 1 = wrong;; 0 = none.
- EX023 — Common factor. What do the three lowest clinics share? Rubric: 3 = a part-time local IT contact;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX024 — Schedule fix. How is update scheduling changed? Rubric: 3 = lunchtime with restarts outside appointments;; 2 = partly correct;; 1 = vague;; 0 = none.
- EX025 — Imaging control. How are unpatchable imaging computers protected? Rubric: 3 = isolated segment and restricted access;; 2 = partly correct;; 1 = vague;; 0 = none.
Continue studying — lesson 05 (chapter 05 of 12)
← Chapter 04 · Course chapter index · Chapter 06 →
Continue to the next authored lesson.