What are patches?
The word “patch” describes its function very well: Just as a patch can fix a hole in clothing or other fabrics, software patches close gaps in IT applications. Patches are used to update, improve, extend or even correct software applications. Under certain circumstances, this can happen without the user’s intervention.
In general, there are four categories of patches: bugfix, hotfix, security patch and the update.
Bugfix: In a bugfix, software errors are corrected and eliminated. When a program has a “bug”, there are glitches or failures and the user cannot use the software as intended by the developers. Examples are: A function can no longer be accessed, the login does not work, or the program closes by itself.
Hotfix: A hotfix also fixes software errors. The only difference to a bugfix is the urgency with which the issue is resolved. This is where the name “hotfix” comes from. Here, the English words “hot” and “fix” are combined, suggesting that the software error is a critical problem that must be solved quickly. An example could be that the problem leads to an accumulation of customer complaints, that the error affects other applications or even further production areas.
Security patch: A security patch is a bug fix for a vulnerability that poses an increased security risk to the organization. This occurs when criminal actors can exploit existing vulnerabilities in a piece of software and gain access to the system to execute malicious code, compromising the entire system. Zero-day vulnerabilities are particularly tricky. In these cases, cybercriminals know about the existing vulnerability and exploit it before the software vendor is even aware of the vulnerability’s existence, and thus before a security patch can be made available to users. Well-known zero-day vulnerabilities include the security vulnerabilities around Microsoft Exchange Server. Here, too, attackers have already exploited the vulnerabilities before Microsoft itself knew about the gaps.
Updates: Updates are enhancements and renewals of existing software. Unlike the previously mentioned examples, this is not about fixing a bug or a malfunction, but about providing the user with further developments or optimizations of the software – e.g. through new features, new functions or simply an increase in performance.
Why are they so important?
Patches and updates have many advantages. Updates often provide improved performance. Processes and operations are often simplified and optimized. They also ensure that compatibility with other software applications or hardware elements is maintained.
Above all, however, the security aspect plays a major role. If bugs and errors are not fixed in time, there is a risk that they will become more vulnerable to viruses, trojans and other malware (malicious software). Security patches should always be installed promptly. This is the only way to ensure that no criminal actors exploit these gaps to gain unauthorized access to the systems.
How do you manage patches properly?
- Keep yourself informed on a regular basis. If you use software applications in your company, it is advisable to keep an eye on developments around this software so that you can react quickly in the event of gaps. If you cannot do this yourself, talk to your IT service provider.
Note: Perseus offers a threat newsletter to all companies using the online cybersecurity portal, informing them of current security vulnerabilities. - Apply patches – and especially security patches – immediately and without delay.
- Install software updates as soon as possible as well.
- Create a policy for handling patches and clarify responsibilities and accountabilities within your organization. Make sure all employees are aware of the policy and know who to contact if needed.
Note: Cybersecurity guidelines – including one on patch management – will soon be available for purchase from Perseus. Visit our website for more information.