3 Reasons Why Patching Matters
Why Patching Matters
Whether its older incidents such as the famous Equifax breach or more recent events like the Microsoft Exchange incursion, investigation into the underlying causes of security failures reveals two key areas: user insecurity (opening a phishing email attachment, being careless with credentials, etc.) or not applying an approved patch for a known vulnerability.
The human factor must be addressed via effective security awareness training, but the patching problem is down to either an inadequate patch management system or not following industry best practices for patching.
Here are three reasons why patching matters:
1. Cybercriminals are Lazy
Yes, there are a few criminal masterminds and gifted hackers out there who come out with ingenious new ways of navigating around and penetrating organizational defenses. They earn all the headlines (as well as the jail sentences). As a result, there is a mistaken perception that all cybercriminals fall in this bracket.
The reality is that the vast majority of them are lazy. They plod along pinging systems to discover if they have failed to protect against known vulnerabilities. We are not talking about a few days after an exploit is discovered and a patch is released. In some cases, a great many months can go by without a critical security hole being plugged. Hackers know this. It’s their bread and butter.
A study by Flexera found that more than 80% of vulnerabilities have a patch within 24 hours of public disclosure, yet 99% of exploitation targets are publicly known vulnerabilities. That’s why the bad guys focus on existing holes that nobody bothered to fix. Why be brilliant when there are rich pickings out there even in large organizations. Patching, therefore, closes the door on 99% of potential security weaknesses.
2. Ransomware Sucks
More than half of all organizations experienced a ransomware attack – more than two million incidents in 2019, according to Enterprise Strategy Group (ESG). Cybercriminals extort billions via ransoms. As well as the financial losses, organizations find themselves locked out of critical systems. After the dust settles on an attack, it is quite common for the fallout to continue. Executives lose their jobs for inadequate funding of security, and IT staff are let go for taking their eye of the patch management ball.
Unfortunately, the ransomware situation worsened in 2020 due to so many working from home. And it will probably spike again in 2021 as people return to the office with unpatched or mispatched devices. The morale of the story is clear. Extra attention to patching today could prevent a ransomware catastrophe tomorrow.
3. Automated Patching Works
Some areas of IT are deemed more attractive than others. Application development, the cloud, and analytics are likely to earn far more executive admiration and have greater pay increase potential than routine administrative tasks such as backup and patching. Yet both can become very exciting (in a bad way) in the wake of a disaster or data breach if they fail to safeguard the organization.
By their very nature, both activities tend to be neglected if they are dealt with manually. They require automation and good oversight if they are to consistently protect the organization.
Organizational best practices always include efficient and timely patching of IT systems with priority given to those areas judged to be of the highest priority in terms of productivity, revenue, and security.
“Effective patch management mitigates risk by eliminating domain-specific activities and applying standard processes across all enterprise systems,” said Gartner analyst Terrence Cosgrove.
How Syxsense Makes Patch Management Easier
Syxsense lets you easily manage unpatched vulnerabilities with the click of a button. It includes patch supersedence, patch roll back, and a wealth of automation features.
In addition, it provides a three-hour turnaround for the testing and delivery of new patches as well as technology to send software and patches across the wire once, using peer-to-peer within the network for local distribution.
Start Your Free Trial of Syxsense
Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.
