November 2021 Patch Tuesday forecast: More mandates in the United States

The global holiday season is upon us with Diwali happening now, Thanksgiving the end of the month, and then on to Christmas and New Years! But before we all start celebrating, we have November 2021 Patch Tuesday coming this week, which is an important one for many industries particularly retail.

November 2021 Patch Tuesday forecast

These updates are often the last ones installed before going into the holiday shopping season when many companies lock down their systems to prevent disruptive changes. This industry is not the only one under pressure to get systems patched, because the US federal government is also being given a mandate to update their systems in the next two weeks.

The President signed an Executive Order back in May to provide more focus on protecting federal government networks. Highlights included sharing threat information between government and private sectors, improving detection and response to security incidents, and improving remediation capabilities to known vulnerabilities.

The Wall Street Journal reported CISA was releasing a directive that would require most government agencies to address “200 known security flaws identified by cybersecurity professionals between 2017 and 2020 and an additional 90 discovered in 2021 alone that have generally been observed being used by malicious hackers” in the next two weeks. Two weeks is a quick turnaround, but hopefully most of these vulnerabilities have been remediated already via regular patching or other mitigations.

In light of the recent supply chain attacks, ongoing ransomware incidents, and continual phishing activity, this mandate should raise the bar on system security.

Knowing vendor-supplied severity ratings and CVSS scores are often not enough to ensure you are focusing on the right vulnerabilities first. The fact that there is a list of nearly 300 security vulnerabilities in the CISA priority list and 200 are two to four years old emphasizes a need to improve how vulnerabilities are identified and prioritized.

Risk based vulnerability management focuses on classifying assets and weighting prioritization on real world risk indicators. This can be a challenging process, but with the proper tools in place you can quickly identify the highest risk vulnerabilities on the more critical systems to patch first and work down the list from there.

Most companies are focused on getting all their updates out before the holidays, so expect multiple releases over the next 2-3 weeks. Here’s what’s ‘on tap’ for this Tuesday.