Cyber Security Basics · Lesson 4 of 10
Quick answer: Why supported software and regular security updates are fundamental cyber security controls for business devices, applications and network equipment.
Security updates fix weaknesses in operating systems, applications and devices. When a vulnerability becomes known, attackers can scan for organisations that have not installed the relevant fix. Patch management is therefore one of the most practical ways to remove avoidable attack routes.
What needs to be updated?
- Windows, macOS and other operating systems.
- Web browsers and productivity applications.
- Mobile phones and tablets.
- Servers and virtual machines.
- Firewalls, routers and network equipment.
- Remote-access tools.
- Website software, plugins and frameworks.
- Business applications installed on endpoints.
Unsupported software is a different problem
If a product is no longer supported by its manufacturer, new security weaknesses may not be fixed. A patching process should therefore identify unsupported operating systems, applications and devices as well as missing updates.
Automate routine patching
Relying on every employee to remember updates is unreliable. Where possible, centrally manage updates, monitor failures and report devices that fall behind. A managed IT or security service should be able to explain which devices are covered and how exceptions are handled.
Prioritise internet-facing and high-risk systems
A vulnerable system exposed directly to the internet can present greater risk than an isolated device. Critical security updates for firewalls, VPNs, remote-access products, browsers and widely exploited software should be assessed quickly.
Do not forget firmware
Network appliances, printers, access points and other equipment can contain software that also needs updates. Include them in the asset inventory rather than treating patch management as “Windows Update only”.
Create a simple patching policy
Your policy should define who is responsible, how critical updates are prioritised, how failed updates are identified, when restarts are allowed and what happens when a device is no longer supported.
What to do after this lesson
Create a list of business devices and check whether each one is supported and receiving updates. Anything unknown should become an action rather than an assumption.
Frequently asked questions
Are automatic updates enough for a business?
They are a good starting point, but businesses also need visibility of failed updates, unsupported software and devices that are not being managed.
Do firewalls and routers need security updates?
Yes. Network equipment runs software and firmware that can contain vulnerabilities.
What is patch management?
Patch management is the process of identifying, testing, deploying and verifying software and firmware updates across business systems.
Useful UK guidance
Put the lesson into practice
39Security helps small businesses turn cyber security guidance into practical controls and owned actions.
- Take the free cyber security assessment
- View practical cyber security training dates
- Explore Cyber Essentials readiness support
- See managed cyber security services
- Read the small business cyber security FAQ