Patch management means identifying outdated or vulnerable software, devices, and operating systems — and then patching those components. In contrast, vulnerability management entails searching for and patching vulnerabilities in your environment. To manage your vulnerabilities, you have to patch them. And to patch them, you have to know what’s vulnerable in your environment.
Once you read that paragraph two or three times, you’ll arrive at this conclusion: Patch management and vulnerability management are not the same, but they do go hand in hand. Without vulnerabilities, we wouldn’t need patches. And without patches, we wouldn't have a way to manage vulnerabilities. Don’t you just love a harmonious yin-and-yang scenario?
What is the patch management process?
As a sysadmin, you likely have patch management high on your to-do list — along with 15 other “high-priority” items that “have” to get done by end of day. (That’s why they pay you the medium bucks.) And to be fair, patch management is critical to ensuring your environment stays secure.
We can break down patch management into three main steps: planning, testing, and deploying.
1. Plan
When you’re in the planning stage, you’ll look at your asset inventory to get a bird’s-eye view of what’s in your environment. From there, you can see which software or hardware versions are outdated. This will help you determine which patches you need to keep your environment in shipshape.
2. Test
Next, you’ll test each security patch in your environment. As we all know, the golden rule of IT is (say it with me) never deploy something to prod until you test the tar out of it.
Round up a small group of computers (preferably from different departments) to deploy patches to. Did anything break? If not, move right along to large-scale deployment. If so, congratulations — you’ve got only a handful of computers to fix rather than your entire fleet!
3. Deploy
Once you test those patches and confirm that nothing has broken, h̶e̶a̶d̶ b̶a̶c̶k̶ t̶o̶ t̶h̶e̶ s̶e̶r̶v̶e̶r̶ r̶o̶o̶m̶ a̶n̶d̶ t̶h̶a̶n̶k̶ t̶h̶e̶ c̶o̶m̶p̶u̶t̶e̶r̶ g̶o̶d̶s̶ you can deploy the patches to your devices. Again, you’ll want to keep a watchful eye on your environment to make sure the patches don’t break anything. And because you already tested the patches on a small, representative group of devices, the likelihood that something will break is minimized — and if something does break, there’s a good chance it’ll be a smaller group of machines rather than your whole environment.
Patch Tuesday: Microsoft’s monthly memo
The second Tuesday of every month marks Patch Tuesday, when Microsoft releases a bulletin with its latest patches. As soon as Microsoft announces the month's patches, our team gets to work analyzing the month’s threats and highlighting the most important stuff sysadmins need to know.
Check out our Patch Tuesday recaps and videos.
Why does patch management matter?
Patch management matters for three main reasons:
It strengthens your cybersecurity posture.
It fixes bugs in your software or hardware.
It increases your team’s productivity.
Patching strengthens your cybersecurity posture
When you run outdated programs in your environment, you’re slapping down a red carpet for hackers to mosey on down. Vendors release patches when they discover a flaw in their software. And sometimes, that flaw can open up the door for external cyberthreats.
Hackers love an easy way in. It’s up to us to make their lives less enjoyable.
Patches also fix bugs
You know that one annoying bug in that one program that adds an extra character every time you type? Vendors release patches to fix those pesky bugs. As a result, the software improves, which directly correlates to your work life improving. Sometimes, it’s the little things.
Patches increase productivity
And with fixed bugs and fewer extra characters comes a productivity increase. Plus, patches sometimes include additional features for your favorite platforms. If you never update your software, you’ll be stuck with the original version you purchased. And you know from experience how tech giants struggle to leave their programs alone once released. 😅
What is vulnerability management?
Moving on to the “yang,” vulnerability management lives on the other side of the coin. To know what needs patching, you have to know which vulnerabilities are floating around out there. You make those discoveries through vulnerability management.
Vulnerability management includes five main steps, beginning with inventorying your assets. Then, you assess, prioritize, remediate, and monitor the vulnerabilities you discover. Note that vulnerability management is not a fun manual experience. We recommend implementing a vulnerability management solution to automate some of the processes.
1. Inventory
Much like with patch management, you’ll begin vulnerability management by looking at your asset inventory. But this time, you’ll look at it through the lens of vulnerabilities.
See a breaking news story about a major vulnerability? You can use your asset inventory to know if the news impacts you — and to what extent. But oftentimes, your vulnerability management solution will already be on top of it (unless it’s breaking breaking news).
You can also use a vulnerability scanner to take an in-depth look at your environment. Vulnerability scanning helps you identify known vulnerabilities across your devices, which significantly decreases the manual work in the process.
2. Assess
Next, you’ll assess what each known vulnerability means to you and your unique environment through a vulnerability assessment. Just because the world is panicked over a vulnerability doesn’t mean it’s a red-alert crisis for you. For example, a critical vulnerability that allows remote code execution is terrifying ... but maybe not so much if the impacted program is on a computer that doesn’t connect to the internet.
3. Prioritize
Now that you have some context around your identified vulnerabilities, you can prioritize them. Choose the vulnerabilities that could potentially do the most harm and address them first. For example, that private computer I described in the last section? Small potatoes in comparison to the zero-day that impacts your public-facing computers.
4. Remediate
With your tidy prioritized list in hand, you can work on remediating vulnerabilities. This is where vulnerability management and patch management meet in the middle. To remediate vulnerabilities, you patch them. At this point, patch management takes over.
Usually. But in some cases (like with zero-days), you might not be able to spring into action as quickly. But that doesn’t mean you have to be a sitting duck, either.
If a patch isn’t available yet and the vulnerability is serious, you move on to plan B: implementing a workaround. For example, disabling a specific service, port, or setting can sometimes be enough to keep you safe while vendors develop a patch.
Or, you can just shut down all your servers and devices and leave for the day. We wouldn’t recommend it, but there's no denying the temptation is there.
5. Monitor
And thus, the cycle repeats. You’ll monitor for additional vulnerabilities (hopefully with the help of a vulnerability management tool) and address the critical ones as quickly as possible.
Why does vulnerability management matter?
Vulnerability management shares importance with patch management. Both processes help keep your environment as secure as possible. Vulnerability management alerts you to known vulnerabilities that need addressing — and through patch management, you address them.
Patch management and vulnerability management FAQs
What is a patch?
A patch is an update for software, devices, or operating systems that fixes a known error. These known errors could be glitches or bugs as well as vulnerabilities.
What is a vulnerability?
A vulnerability is a weakness or error in software, hardware, a network, or a system. Vulnerabilities threaten businesses because cybercriminals often leverage them to launch cyberattacks.
Do all vulnerabilities need to be patched?
No, not all vulnerabilities need to be patched — at least not right away. Although vulnerabilities are ranked for their severity, that ranking is generalized and geared toward many — not all — organizations. And that level of severity could be very different for your unique environment.
For example, a vulnerability with a CVSS score of 10 might not be critical to you if the vulnerability lives on an isolated, disconnected machine. And while we’d patch all vulnerabilities in an ideal world, realistically, we have to prioritize the patches with the greatest potential impact on our environment. (In other words, if a high-severity vulnerability is announced and it impacts your environment, patch ASAP!)
