In this video, we walk through 5 ISC practice questions on patch management. These questions are from ISC content area 1 on the AICPA CPA exam blueprints: Information Systems and Data Management.
The best way to use this video is to pause each time we get to a new question in the video, and then make your own attempt at the question before watching us go through it.
Patch Management
A patch is an update a software vendor releases to fix a problem in its product. Many patches fix security vulnerabilities, but patches also correct bugs, improve stability, and sometimes add functionality. Installing the patch is what actually closes the problem on a given system.
Patch management is the structured process an organization follows to make sure those fixes are identified, tested, applied, and confirmed. Without it, updates get installed only when someone happens to notice a notification, and some systems can go months without being updated. A fix being available doesn’t help if it never reaches the systems that need it, and once a vulnerability is publicly known, attackers can move quickly to exploit it.
Prioritizing and Scheduling
Prioritizing is deciding which patches get applied first. The order is based on how serious the problem is that the patch fixes and how important the affected system is. Vendors usually rate their patches as critical, high, medium, or low, and a vulnerability attackers are already actively exploiting raises the urgency further. System importance depends on what the system does and how exposed it is.
For example, a critical patch for an internet-facing server that processes customer payments would come before a minor bug fix in an internal reporting tool, even if both were released the same week.
Scheduling is deciding when patches are applied. Most organizations patch on a regular cadence during planned maintenance windows, such as a weekend night when few people are using the systems, so the work disrupts the business as little as possible. A critical patch for an actively exploited vulnerability may not wait for the next regular window and can be applied ahead of schedule as an emergency change.
Validating and Testing
Validating confirms a patch is legitimate and applicable before it is installed. Legitimate means the patch actually came from the vendor and hasn’t been altered, which matters because attackers sometimes disguise malware as software updates. Obtaining the patch directly from the vendor and checking its digital signature addresses this. Applicable means the patch is meant for the versions and configurations the organization actually runs.
Testing is a separate step. The patch is installed in a non-production environment, a copy of the live systems that isn’t used for real business, to see whether it causes problems or conflicts with other software. If a patch breaks an accounting application on a test server, the organization can hold the patch and contact the vendor instead of discovering the problem in production. Validating asks whether the patch is genuine and the right one, while testing asks whether it causes problems once installed.
Deploying
Deploying is installing the patch on the live systems the business uses. Even after testing, organizations usually deploy in phases. The patch first goes to a small pilot group, and if those systems run normally, it is pushed to everyone else. A test environment is only a copy of production, so a pilot catches problems testing missed while limiting how many systems are affected.
A rollback plan allows the organization to undo the patch if it causes problems. Backups are part of that plan and need to be taken before the patch is applied, since the point is to have a copy of the system in its pre-patch state to return to.
Monitoring
Monitoring confirms the patch did its job. The organization checks that the patch was installed on every system that needed it and that those systems are running normally afterward. Any system that missed the patch still has the vulnerability, so it is identified and patched once it becomes available, such as a laptop that was powered off while its user was traveling.
Monitoring is also ongoing. Organizations keep watching for new vendor releases and vulnerability announcements, and each new patch starts the process again with prioritizing.
