Patch Management

A patch is a revision to operating system or application software code; patches are also called hot fixes and service packs. NIST guidance frames patching as preventive maintenance for technology and a cost of doing business. It applies to IT, operational technology, Internet of Things devices, mobile devices, and cloud computing, and to every type of patchable software on those assets, including applications, operating systems, and firmware.

Preparing a patch includes prioritizing it, scheduling deployment, acquiring it, confirming its authenticity and integrity, and testing it before it reaches production. Deployment then distributes the patch to the assets that need it and installs it, and the organization verifies the deployment and monitors the deployed patches afterward.

NIST describes four scenarios to plan for. Routine patching covers patches on a regular release cycle and is the bulk of patching. Emergency patching handles a severe vulnerability or one being actively exploited. Emergency mitigation reduces risk temporarily before a patch is available. Isolation or other methods protect assets that cannot be patched. Because routine installation can interrupt operations, for example with device reboots, it is often postponed, which gives attackers more windows of opportunity and makes later emergency patching harder.

Immediate patching is not always possible. A patch may not be released yet, the vendor may no longer support the software, or the organization may need to wait for an outage window or test first. A patch can also be flawed and fail to fix the vulnerability, disrupt other software or systems, or even be compromised.