December 2020 Patch Tuesday forecast: Always consider the risk

The final Patch Tuesday of the year is upon us and what a year it has been. Forcing many changes this year, the pandemic has impacted the way we conduct both security and IT operations. But even with the need to support remote operations and new applications that enable coordinated communication, one important aspect has not changed – the need to focus on security risk.

December 2020 Patch Tuesday forecast

It’s easy to get consumed with troubleshooting performance issues, updating applications to provide the latest features, and other similar day-to-day activities, which can result in losing track of maintaining security of our systems.

In this monthly column, I focus on Microsoft updates and some of the more commonly used applications that require frequent security releases such as Adobe Reader, Google Chrome, Mozilla Firefox, etc. But we need to keep in mind that periodic updates are being released for all the applications we use and many of those updates include critical security fixes for vulnerabilities that are being exploited.

Very few (if any) of us are in a position to instantly update all the systems in our organizations, so we need to prioritize what needs to be updated first, and that should be driven by risk.

Risk is an interesting concept, because determining if one system is at a higher security risk than another can depend on many factors, which vary not only from company to company, but may change across departments within the same company.

We think about risk in general terms with regards to the importance of the system to the company’s business, the vulnerability state of the system, and the threat to the system. Each of these can be further broken down into factors of importance for the company. For example, we think of vulnerability state in relationship to factors such as patch state, configuration state, password compliance, user privileges, etc. These are just a few of the factors in one small area that can be used for risk determination.

Many companies and tools are available to help you, or maybe you have your own process already in place to determine risk and prioritize system updates.

Coming back to vulnerabilities in software and the need to patch, I’d like to point out a recent report from the NSA which itemizes a series of vulnerabilities being actively exploited. You’ll notice a wide range of vulnerabilities. Several like the Netlogon, have been in the news.

A wide range of impacted software, operating systems, VPNs and other security products are included as well. Please review and carefully consider this information as part of your next risk assessment as you prioritize your December updates.