Patch Management

Patch management is the structured process a business uses to track, review and install available security updates for operating systems, applications and devices. The purpose is to close known security vulnerabilities before they get exploited – such vulnerabilities are documented publicly as CVE entries (Common Vulnerabilities and Exposures) once they become known. Without a structured process, whether and when a known vulnerability gets closed is left to chance.

In practice, vendors release updates on a fixed schedule, such as Microsoft's second Tuesday of every month, known as 'Patch Tuesday'. Working patch management first tests an update in a test environment or on non-critical devices before rolling it out everywhere, and keeps a record of which version is running on which device. For a business, this usually only becomes visible as a scheduled maintenance window in which devices briefly restart.

A common mistake is postponing updates until a restart actually fits the schedule – for servers and machine controllers meant to run continuously, that window often never comes, sometimes for years. It's equally risky to assume a device without direct internet access doesn't need updates, since malware can also spread through the internal network or a USB drive.