December 2021 Patch Tuesday forecast: How do you stack up?

I can’t believe that the end of 2021 is already in sight, and looking backwards, I have to say we’ve had our share of interesting events. If I had to characterize it from a security perspective, I’d say this is the year of supply chain attacks. Prior to January, most of us had rarely heard that term, but then Solarwinds, Kaseya, and others were in the news and we heard it throughout the year.

December 2021 Patch Tuesday forecast

Striking a little closer to home, we’ve all had to deal with PrintNightmare, including the vulnerabilities and the string of software updates and configuration changes needed to deal with it. The news has died down, but it was a hot topic of discussion from June into September. Let’s hope for a few quiet weeks to wrap up the year through the holidays.

I mentioned last month the Cybersecurity and Infrastructure Security Agency released a list of some 200 vulnerabilities which needed to be addressed by federal civilian agencies in just two short weeks. This list, part of Binding Operational Directive 22-01: Reducing the Significant Risk of Known Exploited Vulnerabilities, has been expanded and now provides additional deadlines reaching out to May 2022 for the added ones to be addressed.

But this directive does much more than just require systems to be updated to fix the vulnerabilities. To paraphrase the directive, the impacted agencies must also have policies in place to a) establish a process to manage the vulnerabilities, b) assign personnel to manage that process, c) identify actions to execute the process, d) establish validation and enforcement of the process, and e) provide tracking and reporting of the process.

While there are older vulnerabilities dating back to 2014, most of these vulnerabilities are from 2020-2021 and updating an entire organization can take months of planning and execution if you don’t have an efficient patch management infrastructure in place.

Two of the best sources of information for such an infrastructure can be found in the Center for Information Security (CIS) 18 Critical Security Controls and the NIST Cybersecurity Framework. These documents can help you combine policies, procedures, and the software of your choice into a comprehensive security program tailored for your organization. You can also choose to tactically address a smaller function, such as patch and remediation, and slowly add on other aspects such as account management, data recovery, disaster recovery, and so forth.

Each organization is unique, but the infrastructures recommended by CIS and NIST provide a common set of definitions and comprehensive set of requirements to work from. Assuming we have a few quiet weeks following Patch Tuesday, take a moment to compare your program to these and see how you stack up. There may be room for improvement you haven’t considered before.

I anticipate a very light Patch Tuesday as we are already halfway through December and many vendors have already released their updates for the month.