Patch management

Unpatched software remains one of the main ways attackers get in. Once a vendor releases a security fix, attackers can study it to understand the flaw, and mass exploitation of internet-facing products can begin within days.

Good patch management covers more than Windows updates. It includes third-party applications such as browsers, PDF readers and Java, server software, firewall and VPN firmware, network equipment, printers and line-of-business applications. It also needs a plan for systems that cannot be patched, such as legacy production equipment, which should be isolated and monitored.

Practical targets for an SMB: apply critical updates to internet-facing systems within days, especially when the Canadian Centre for Cyber Security or the vendor reports active exploitation; patch workstations and servers on a regular monthly cycle; and verify that patches actually installed. Retire end-of-life software that no longer receives updates. Cyber insurers commonly ask about patching timelines and unsupported systems, so keep reports that prove your process works.