August 2021 Patch Tuesday forecast: Dealing with emergency patching

The PrintNightmare print spooler vulnerability, CVE-2021-34527, caused a lot of excitement last month. If you’re still in an active patch cycle, ensure you install the latest cumulative (or monthly rollup) to address this vulnerability.

August 2021 Patch Tuesday forecast

If you use Microsoft’s security only updates each month, be sure to include the security only out-of-band updates for your operating systems, because they must be installed for the PrintNightmare fix; they were not included in the Patch Tuesday set of security only updates. Extended Security Updates were provided for Windows 7 and Server 2008/2008 R2, but only if you purchased this service.

The release of zero-day updates, particularly one of this magnitude, provides an excellent opportunity to validate your emergency patching policies and procedures. If last month you were ‘running around with your hair on fire’ as the saying goes, now is the time to plan for the next issue because it is sure to come.

First, you must have a company policy in place which must be negotiated with and agreed upon by your security and legal teams. Some of the factors to consider include your company timeline to install the fixes throughout your network, a risk-based approach to protect the most critical systems, required coordination of activity, and so forth.

The first inclination of the security team is often to roll the updates out immediately, but that can often have a devastating impact on the overall business if the patches don’t perform as anticipated. You must have a trusted and validated process or procedure in place. From a best practices approach, many companies treat emergency patching as an accelerated version of the monthly patch cycle.

The updates are rolled out into a test environment consisting of systems configured to mirror the most critical or the most ‘patch sensitive’ to see how they perform. Once the known issues, if any, are identified you can roll the critical patch out to similar systems in your production environment.

In parallel or series depending upon your company’s capabilities, you repeat the process for a ‘phase 2’ set of less critical systems and so forth. While your normal monthly patch cycle may take 2 weeks of testing, you are usually only testing a single update here, so an accepted observation period may be just 2 days before the live rollout.

The important elements are that you know what to expect when the critical updates are installed, and you know how to respond if something doesn’t go as planned. Again, your company policy and procedure should support each other as the IT operations and security teams work together to secure your environment. There will always be exceptions but working from established procedures is much more comfortable than panicking when an emergency situation like the PrintNightmare vulnerability arises.

The July 2021 Patch Tuesday was an active one with 84 CVEs addressed in Windows 10 including 3 zero-days and 5 publicly disclosed vulnerabilities. I expect a smaller set of updates with fewer CVEs addressed this month as we are in the family vacation season and this year people are taking advantage of it.

One thing to make note of this month is Microsoft is going to enable an application control feature that will block potentially unwanted applications (PUAs). They quietly introduced this feature back in May and made this announcement concerning its enablement in the upcoming August updates. Just a ‘heads up’ in case you start to get calls from your users their personal applications are not working properly. The settings for this feature can be found in the Windows Security setting screen. Selecting Reputation-based protection settings under App & browser control, provides your configuration options.

Don’t forget, Windows 11 was officially announced on June 24. Although the announcement mentioned it would be released around the holidays, early indications are that it will come as early as October which is in line with the new versions of Windows 10 released in the past.