GoKawiilAuthor: Gene Moody, Field CTO at Action1
Patch management has a speeding problem.
The pace at which software changes is increasing, while the time available to IT teams to evaluate those changes is not.
The count and frequency of updates are both increasing, with no clear sign of slowing down anytime soon. New vulnerabilities are disclosed every day. Vendors release fixes on their own schedules. Browsers, operating systems, applications, and infrastructure all produce updates that need attention.
Meanwhile, the teams responsible for analyzing and deploying them are often dealing with limited staff, competing priorities, increasingly complex environments, and policies from a simpler age.
The result is predictable: the backlog grows. And when it happens, organizations start making trade-offs out of necessity. Testing time gets compressed. Review gets skimmed or skipped. Updates that ideally would spend time in a controlled test environment move directly into production because waiting another week may leave a known exposure open for another week, and the risk is too great.
Sometimes there is a legitimate argument behind that decision. A failure you control is generally preferable to a failure induced by an attacker. But that does not mean the answer is to become reckless about deployment. Pressing times sometimes call for hasty decisions.
What you can control, however, is how those pressures affect the parts of the process that remain within your control.
So how do you do that? Make the process smarter.
Automation Is Not the Same as Acceleration
... continue reading