LinkedIn Facebook X

Cybercriminals constantly look for new weaknesses to exploit in applications, software, servers and devices. Those exploits allow them to get access to a device and use it for malicious purposes such as stealing confidential data. In order to counter those exploits, vendors always work on fixing newly discovered vulnerabilities to make sure their products stays secure. Those fixings are made available to the customers through the release of an update. It is thus important for an organisation to keep their software and devices up to date.

Best practices

1. Perform Security updates/patches for all your software and devices when the updates become available

Since it could only take one vulnerability in a system, application or device for cybercriminals to compromise in order to cause damages and get access to the entire environment. Installing updates as soon as they are available is thus crucial to ensure a strong cyber defence and to make sure that the system version being used is still supported by the vendor.

There are two different types of updates to take care of. On one hand, there are updates that aim at fixing security vulnerabilities to make sure a product cannot be compromised. On the other hand, there are updates that aim at enhancing a product from a functionality point of view. Both types are equally important and should be installed as soon as they are available.

To efficiently manage the update process, an organisation should define a series of rules to establish, amongst others, what should be updated, how frequently, who should monitor the availability of new updates and who should make sure they are installed.

Only install applications (operating systems, firmware, or plugins ) needed to ensure your operations and patch/update them whenever possible.

2. Include third-party software in your updates

Third-party software, such as browsers, program extensions and middleware, should also be updated regularly. They represent common ways of exploiting users because of their interactivity.

3. Plan your updates during non-working hours

When collaborators are working on their device, they tend to ignore update notifications so they don’t interrupt their work or lose time waiting for the update to be completed. As updates sometimes take time, it is better to plan them during non-working hours or during less busy periods. Do not plan major updates on a Friday evening to allow potential support in case of problems.

4. Only use official websites to download updates

Cybercriminals display fake update notifications through advertising messages or pop-ups. It is important to download an update only from the official vendor to avoid installing a virus instead. In addition to paying attention to the legitimacy of the website, what is included in the update should also be reviewed to avoid ticking boxes for unneeded features such as an advertisement add-on.

You should only install a current and vendor-supported version of software you choose to use. It may be useful to assign a day each month to check for patches.

5. Automate the update process

Wherever possible, if the system allows it in its configuration, automate the download and installation of new updates to make sure to always have the latest and more secure version released by the vendor. In addition, make sure the update works correctly by checking it manually.

Besides that, there are programs that can scan resources and look for updates needed, in order to give an overview of what should be installed.

There are products which can scan your system and notify you when there is an update for an application you have installed. If you use one of these products, make sure it checks for updates for every application you use.

6. Check for new updates and end of support

In order to avoid missing a crucial update, organisations need to keep on monitoring the availability of new updates for the devices and software they use on the vendors’ websites. In addition, it is also important to establish when a product is no longer supported by the vendor, as it then reaches an ‘end-of-life’ state. That implies that new updates are no longer realized, making the solution vulnerable. It is thus better to anticipate the end-of-life state of a product and migrate the necessary resources on time. Finally, collaborators can also be restricted to install unsupported products by establishing a whitelist of all authorized ones.

Add security measures to devices that cannot be updated

Migrating to another product or a more enhanced one is not always possible and sometimes, an organisation need to keep on using the unsupported version. If this scenario happens, additional security controls must be implemented to protect the current product. A good starting point is to make sure the product in question is completely isolated not only from the rest of the organisation network, but also from outside (i.e., without any connection to Internet)

7. Test the updates

Depending of the importance of the update, the impacts and dependencies may differ. Whenever possible, the updates should be tested before its implementation. A test environment and a reference baseline are a good way to validate updates in an isolated environment similar to the production one. It can also help to test repair scenarios or failed installations

8. Backup your systems, data and servers

It is a good practice to backup data and systems before installing an update to make sure a working version is available in case something goes wrong. Also, it is best to make a full backup of servers before updating them. Having a roll back strategy available when doing updates on those common resources is indeed important to be able to go back to a working server as soon as possible. In addition, the procedure ensuring the roll back should be tested to reduce the negative impact an update could have.

9. Keep track of your updates (e.g., device, software)

Even with a limited number of systems, maintaining an inventory of all the assets available is allowing an organisation to manage the updates process more efficiently. This inventory must always be updated with added or removed assets to represent the current situation as accurately as possible. In addition, when a new device is acquired, it should be reinitialised to the default parameters and have all updates available from the vendor installed before being used.

Resources to go further

From Safeonweb
Additional resources for IT responsible

The aim of this content is to share and raise awareness of good cyber security practice. 
Some of this advice may apply differently depending on the context of your organisation.
Always comply with the policy and instructions in force in your organisation.
If in doubt, always ask your IT manager for advice first.