Lessons · Cybersecurity · patching and the window
Patching, and the window you stand in
A patch fixes a known weakness, and the window is the time between the fix being published and it being installed on your systems, which is when you are most exposed.
Hone is a place to practise a career, one idea a day. This is one of its lessons, written out in full and free to read without an account.
What it is for
The vendor published on Tuesday morning. By Thursday the weakness was being used against everybody who had not installed it, because publishing the fix also tells the world what the weakness was. The team that patched on Wednesday had a quiet weekend.
How to think about it
Have a policy with numbers in it: critical fixes within so many hours, the rest within so many days. Count from the publication time, not from when you noticed. Test on a few machines, then all of them, then check the inventory that it really installed.
Worked example
Policy: critical within 72 hours, high within 14 daysNumbers, so a deadline is a fact rather than a feeling.
Published Tuesday 10:00, so the deadline is Friday 10:0072 hours added to the publication time.
Wednesday 16:00: 30 hours gone, 42 hours left72 - 30 = 42. Count from the vendor's clock.
Pilot 10 machines, then all 400, then confirm from the inventoryPushed is not installed. Check the number that came back.
Your turn
Write the word for the time between a fix being published and it being installed.
the patch
Solve one, graded on the server
The trap
Starting the clock when you read the notice. The attacker's clock started when the vendor published, and that is the clock the deadline is measured on.