Chapter 8 — Patching programme
Lesson map
Lesson 08 published. Map, example, EX036.
flowchart TD
N0["Learning outcomes"]
N1["8.1 Targets"]
N2["8.2 Tail"]
N3["8.3 Servers"]
N4["8.4 Reporting"]
N5["Measuring the tail"]
N6["Third-party applications"]
N7["Outages, emergency and firmware patches"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX036"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["8.1 Targets"]
N2["8.2 Tail"]
N3["8.3 Servers"]
N4["8.4 Reporting"]
N5["Measuring the tail"]
N6["Third-party applications"]
N7["Outages, emergency and firmware patches"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX036"]
[Learning outcomes]
|
v
[8.1 Targets]
|
v
[8.2 Tail]
|
v
[8.3 Servers]
|
v
[8.4 Reporting]
|
v
[Measuring the tail]
|
v
[Third-party applications]
|
v
[Outages, emergency and firmware patches]
|
v
[Worked example] --> [Exercise EX036]
Learning outcomes
You will (1) set patch targets; (2) reduce the tail; (3) report.
8.1 Targets
Fourteen days for laptops and servers, seven for actively exploited flaws, following SP 800-40 Rev. 4 risk-based guidance and the CISA Known Exploited Vulnerabilities catalogue. Separate targets reflect that not all flaws carry the same urgency: a flaw already exploited in the wild needs action sooner than one that is only theoretical. The Known Exploited Vulnerabilities catalogue gives Marlowe a public, regularly updated list to check against. Seun agrees the targets with the infrastructure team and the operations director, and writes them into the standard so that they are measured monthly with the other controls and reported per device group.
8.2 Tail
Laptops in the tail are mostly field staff rarely online; cloud-based update management fixes this. Field staff laptops spend weeks away from the office network, so updates that depend on it reach them late. Cloud-based update management lets laptops receive updates over any internet connection. Seun checks the tail each month to confirm that the change works and to find machines that remain behind for other reasons, such as low disk space or a failed restart. Laptops still in the tail after two months are raised with the user's manager, since field staff may need to connect deliberately to receive updates.
8.3 Servers
Server patching moves to a monthly window agreed with operations. A fixed monthly window lets operations plan around server restarts, rather than being surprised by them. The window falls at the quietest time of the week for deliveries, as agreed with the operations director. Urgent fixes for actively exploited flaws can still be applied outside the window, following the seven-day target, with operations told in advance. The infrastructure team tests updates on the route planning server's copy before the window and records the results. Each month's window, including any failed updates, is logged for the evidence pack.
8.4 Reporting
Monthly percentages per group and the oldest outstanding patch. Percentages per group show typical performance, while the oldest outstanding patch shows the worst case, which an average can hide. Seun reports both to the operations director each month with a one-line explanation of any change. The figures use the reconciled device list as the denominator, so a device that stops reporting counts as a gap rather than disappearing. A short note lists which machines hold the oldest patches and what is being done about them. The same monthly report goes into the evidence pack, so the insurer can see patching performance over the whole programme.
Measuring the tail
Seun reports not just the percentage within target but the list of devices outside it, sorted by days overdue. The tail matters more than the average, because one long-unpatched server can undo everything else. Each device in the tail has an owner and a reason.
In month one, the tail includes eleven laptops over thirty days, mostly belonging to drivers' supervisors who rarely connect to the office network. Cloud update management closes most of these within a month.
The tail list is shared with owners each month.
Third-party applications
Operating system patches are only part of the work. Browsers, PDF readers and the route planning client also need updates. The endpoint management tool's application catalogue now updates these automatically on laptops, and the infrastructure team adds application versions to the server baseline.
A monthly report shows versions of the five most common applications, and any version more than one release behind is followed up.
Applications without automatic updating are flagged as candidates for replacement.
Their owners are asked to find an alternative within a year.
Outages, emergency and firmware patches
Server patching windows are announced a week ahead to operations staff, with a short message on what will be unavailable and for how long, so planners can route around them. For flaws listed in the CISA Known Exploited Vulnerabilities catalogue, the team patches within seven days using an emergency change process that still records what was done. Firmware is part of patching too: laptop and server firmware updates follow the same targets where vendors deliver them through managed channels, and firmware versions appear in the monthly report, because flaws below the operating system are easy to forget and hard to detect.
Worked example
Laptop patching within 14 days rises from 84 to 95 percent.
Synthetic case. Figures are synthetic.
Errors and limits
Targets without exception handling force unsafe rushed changes.
Exercises
- EX036 — Exploited flaws. Why a shorter target for exploited flaws? Rubric: 3 = active risk;; 2 = urgency;; 1 = vague;; 0 = none.
- EX037 — KEV. What is the KEV catalogue used for? Rubric: 3 = identifying exploited flaws;; 2 = list;; 1 = vague;; 0 = none.
- EX038 — Field laptops. How was the field laptop tail fixed? Rubric: 3 = cloud update management;; 2 = updates;; 1 = vague;; 0 = none.
- EX039 — Report fields. Name two report figures. Rubric: 3 = percent and oldest;; 2 = one;; 1 = vague;; 0 = none.
- EX040 — Result. State the laptop change. Rubric: 3 = 84 to 95;; 2 = one;; 1 = vague;; 0 = none.
Synthesis
Risk-based targets and attention to the tail improve patching.
Continue studying — chapter 08 of 12
← Chapter 07 (draft) · Course chapter index · Chapter 09 (draft) →