Patching

First principles

A vulnerability is a defect someone else can use. Patching is closing that defect on the systems you actually run. Priority is a function of exposure and evidence of use, not of the size of the vendor's version number and not of CVSS alone. A 9.8 on a host nobody can reach is not your first hour. A 7 on the box that terminates the internet, with a KEV entry, is.

CISA's Known Exploited Vulnerabilities catalog is a list of CVEs with evidence of in-the-wild use and a fix. Vendor advisories say the same in product language. You do not need a feed into a SIEM to read either. You need an owner who looks, a list of what you run that faces a network, and a window measured in hours and days for those two queues.

Why 'we'll do the quarter' fails

A quarterly patch cycle is a change-management comfort. It assumes the defect waits. Known-exploited and internet-facing defects do not wait. The time from advisory to attempts is often shorter than a CAB. If your only path to production is a freeze, you do not have a patching program. You have a freeze with exceptions you will make badly, under pressure.

What an admin actually does

• List internet-facing systems. Names, owners, current versions, how you patch them. This is the first queue.
• When a KEV entry or a vendor advisory names a product you run, it jumps the queue. Hours and days, not the next maintenance Saturday.
• Applications and operating systems both count. Firmware and hypervisors count. A patched OS behind an unpatched appliance is still open.
• Evidence the patch. A ticket that says 'scheduled' is not evidence. A version string after the change is.