The Software Patching Problem - Solved

While the pace of innovation in application development has advanced, the fallibility of the humans creating those applications remains a weak link in cybersecurity. Thus, with every new software release, you can expect some bugs, glitches and vulnerabilities — and, in their wake patches.

Software patches are regularly released in response to discovering new security vulnerabilities, often critical. The patches should be implemented as soon as they are released to prevent potential breaches. Additionally, other steps may be taken after the patch is deployed.

For example, in December, Citrix released a security update to address a zero-day vulnerability that could have allowed attackers to exploit a Citrix appliance and potentially take over a system. Barracuda recommended that organizations update the software and ensure that all instances of the Citrix ADC are behind a VPN that requires authentication before access. Barracuda also recommended that organizations review the NSA Threat Hunting Guidance to check for potential indicators of compromise.

A similar vulnerability was discovered in Fortinet in December that required a FortiOS patch to prevent unauthorized code execution. Barracuda also recommended a review for indicators of compromise, as well as blocking connections to suspicious IP addresses from the FortiGate.

In both cases, users needed to take swift action to protect themselves. However, managing critical security patches can be daunting for an IT department, particularly in complex environments with multiple appliances, applications, and on-premises and cloud-based platforms. Additionally, it can be challenging to prioritize multiple patches, particularly in environments where it is difficult to get a comprehensive view of all vulnerabilities. For MSPs, that problem is compounded across a large, diverse client base.

Making the Case for Automated Patch Management

Automated software management tools can help MSPs and their clients streamline patch management. These solutions are built to make patch/update activities more efficient by scanning the software inventory, issuing patch alerts, prioritizing deployments, and even testing and reporting without manual intervention. While some essential tools push out patch/update reminders, advanced solutions can manage all aspects of the process across complex IT environments.

Offering these services is vital for MSPs for several reasons.

First, weak patch management practices can leave an organization vulnerable to otherwise avoidable attacks. Many data breaches have occurred when available patches weren’t applied because companies simply couldn’t keep up. MSPs can offer 24/7 monitoring and automated patch management that improves security without straining a company’s internal resources.

Leveraging automated patch management lightens the load for MSP staff by providing a centralized view of client software. It enables them to apply patch updates across the customer network with less labor. For security-centric MSPs, this ability can also make other security services easier to manage: If you can stop a fair number of attacks just by having the patch in place, it reduces the burden of identifying and responding to active cyberattacks after the fact.

Getting a holistic view of vulnerability and patch activity improves an MSP’s grasp of evolving security threats and enhances response rates. A Ponemon Institute survey found that 80% of organizations that use automation report that they can respond to vulnerabilities in a shorter timeframe. This can also improve regulatory compliance and help maintain cybersecurity insurance.

Finally, not leveraging automated patch management leaves money on the table. A recent market report predicts that the patch management market could reach more than $1 billion globally by 2027, with a compound annual growth rate of 10.7%. MSPs that can effectively address this problem for clients can tap into an expanding stream of new revenue.

In addition, patches give clients access to new software features and improvements, apart from simply addressing security problems. Keeping on top of updates can also help companies avoid software compatibility and integration issues.

Automated patch management helps save small and midsize clients time and money by removing the burden of patch management and ensuring that security updates are deployed quickly and accurately. Unfortunately, most companies do not have the expertise, staff or time to manage patching effectively. MSPs can provide a valuable service by adding these capabilities to their security toolbox. It is also important to remember that patch management doesn’t stop with the OS; it extends to all other applications. Yet not all patch management solutions offer the same level of coverage. As such, MSPs should seek a patch management automation tool that covers the widest possible assortment of applications.

Want to learn more? Read The MSP’s Guide to Patch Management Best Practices for a step-by-step guide to building an automated patch management service.

Chris Crellin is Senior Director of Product Management for Barracuda MSP, a provider of security and data protection solutions for managed services providers, where he is responsible for leading product strategy and management.

 This guest blog is part of a Channel Futures sponsorship.