Chapter 15 — Patching applications and firmware
Lesson map
Lesson 15 published. Map, example, EX043.
flowchart TD
N0["Learning outcomes"]
N1["15.1 Applications"]
N2["15.2 Central updating"]
N3["15.3 Firmware"]
N4["15.4 Unsupported applications"]
N5["Browser extensions"]
N6["Measuring currency of applications and drivers"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
N7 --> EX["Worked example"]
EX --> Q["Exercise EX043"]
Logical drawing
flowchart LR
N0["Learning outcomes"]
N1["15.1 Applications"]
N2["15.2 Central updating"]
N3["15.3 Firmware"]
N4["15.4 Unsupported applications"]
N5["Browser extensions"]
N6["Measuring currency of applications and drivers"]
N7["Synthesis"]
N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX043"]
[Learning outcomes]
|
v
[15.1 Applications]
|
v
[15.2 Central updating]
|
v
[15.3 Firmware]
|
v
[15.4 Unsupported applications]
|
v
[Browser extensions]
|
v
[Measuring currency of applications and drivers]
|
v
[Synthesis]
|
v
[Worked example] --> [Exercise EX043]
Learning outcomes
You will (1) inventory installed applications; (2) keep them updated; (3) update firmware.
15.1 Applications
Browsers, PDF readers, office apps and classroom tools all receive security updates. Tomás exports installed applications from the management service and finds four versions of the same PDF reader, two out of support.
Applications matter as much as the operating system because staff open documents and web pages in them every day, which is where most malicious content arrives. Four versions of one PDF reader mean four different sets of missing fixes, and two out-of-support versions will never be fixed at all. Tomás records the count of laptops running each of the four versions.
15.2 Central updating
Dev packages the current PDF reader in the management service with automatic updating and removes old versions. Browsers update themselves, but Tomás checks that the update service is not disabled.
Packaging one version centrally means new laptops get the same reader as old ones, and the vendor's automatic updates keep it current without Dev repackaging it each month. Removing the old versions is part of the change, because otherwise a second, unpatched reader stays installed and can still open attachments if a file association points to it.
15.3 Firmware
Laptop firmware updates are delivered through the vendor's tool. Dev enables firmware updates through Windows Update for supported models and records firmware versions in the inventory.
Delivering firmware through Windows Update means it follows the same rings as other updates, so a faulty firmware release reaches the first ring before anyone else. For models not supported that way, Dev uses the vendor's tool on laptops brought into the office on mains power. The three outdated laptops from the hardware check are updated first, and their new versions recorded.
15.4 Unsupported applications
One classroom app is no longer maintained. Tomás records it as an exception with an alternative to be chosen by the next school year.
The app is used for phonics lessons in one school, so removing it before a replacement is chosen would disrupt teaching. The exception records the app's name, why it is still needed, what limits apply, and the date by which the computing lead will propose an alternative. Dev reviews the exception each term, so it cannot quietly become permanent.
Browser extensions
Browser extensions can read and change the web pages a user visits, including the school's management information system. Many free extensions are harmless, but some collect browsing data or are sold to new owners who change their behaviour. Tomás reviews extensions on a sample of laptops and finds several that nobody can explain. Dev sets a policy allowing only approved extensions, after asking teachers which ones they use in lessons. Teachers can still request new extensions through the self-service process, where Dev checks the publisher and the permissions requested. This reduces both risk and clutter without stopping legitimate classroom use.
Measuring currency of applications and drivers
Tomás adds a monthly count of laptops running an out-of-date version of each key application. The first report exposes the PDF reader problem; later reports show it stays fixed, and a count that stays at zero is good evidence for auditors that application patching works. Drivers matter too: wireless and graphics drivers run with high privilege and receive security fixes. Dev allows driver updates through Windows Update for supported models after they pass the first ring, and the monthly report includes the driver version for the two most common laptop models so that any model left behind is visible.
Worked example
After central packaging, all 94 laptops run the same current PDF reader.
Synthetic case. Figures are synthetic.
Errors and limits
Firmware updates can fail if a laptop loses power; apply them only on mains power.
Exercises
- EX043 — Application sprawl. Why do multiple versions of one app cause risk? Rubric: 3 = old versions miss fixes, harder to manage;; 2 = old;; 1 = vague;; 0 = none.
- EX044 — Firmware care. Give one precaution for firmware updates. Rubric: 3 = mains power with reason;; 2 = precaution;; 1 = vague;; 0 = none.
- EX045 — Unmaintained app. What should happen with an unmaintained classroom app? Rubric: 3 = exception with deadline and replacement;; 2 = replace;; 1 = vague;; 0 = none.
Synthesis
Patching covers applications and firmware, not just the operating system.
Continue studying — chapter 15 of 30
← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →