Patch Tuesday is not an event. It is a calendar entry, and small IT teams that treat it that way tend to have fewer bad surprises. This is a boring, repeatable routine you can adopt before the holiday change freezes arrive. It names no vulnerabilities on purpose: the routine is the point.
The calendar
Microsoft publishes its monthly security update on the second Tuesday of each month, typically at 10:00 a.m. Pacific. Put the next two release days on the team calendar now, along with a review day after each one. Microsoft also describes out-of-band updates, which are released as needed when an issue or vulnerability cannot wait for the next monthly update. Those do not follow the calendar, so the routine needs a lane for them (see below).
Inventory before patching
You cannot patch what you cannot list. CISA’s ransomware guide calls for a comprehensive asset inventory and for prioritized patching of internet-facing systems. In practice, start with a single list that covers:
- Servers and workstations, with operating system and owner.
- Internet-facing systems: VPN appliances, firewalls, remote access gateways, web servers.
- Edge devices that few people log into. These are commonly the ones that fall behind.
- Third-party software that has its own update process.
Internet-facing systems go first in each cycle. They are the doors an attacker can reach without already being inside.
Three rings, each with a date
Rings turn “we will get to it” into a schedule.
1. Pilot: a small group of IT-owned machines and a low-risk server or two, updated soon after release. Their job is to find breakage.
2. Broad: the main user and server population, updated once the pilot has run without trouble. Give it a date, not a feeling.
3. Stragglers: laptops that were off, servers waiting on a maintenance window, devices with exceptions. Give this ring a firm date too, and name an owner for each exception.
Write the three dates on the calendar the same week the update ships. A ring without a date is a wish.
An emergency lane for out-of-band releases
Decide now what happens when an out-of-band update or an urgent advisory for an internet-facing product arrives. A workable lane is short:
- One named person watches vendor advisories and decides whether the emergency lane applies.
- Internet-facing and actively exploited issues skip the broad schedule: a fast pilot, then production.
- A rollback plan exists before the change, not after.
- If patching has to wait, apply an interim control (restrict access, disable the exposed feature) and record the exception with an expiry date.
Holiday freeze rule: freeze features, not security fixes
Change freezes are sensible. Few teams want a new application rollout the week half the staff are on leave. But a freeze that also blocks security updates leaves the quietest period with the oldest software. An earlier CISA and FBI advisory noted that attackers have often taken advantage of holidays and weekends, when fewer people are watching.
Write the rule down: a holiday freeze covers feature changes, migrations and non-urgent upgrades. Security updates for internet-facing systems continue, using the normal rings on a compressed schedule, and someone is named as on call. This is our recommendation, and it works best when it is agreed before the freeze starts, not argued during it.
Prove it: one report showing what is behind
Finish each cycle with a single report that answers one question: what is still not patched, and why? It should list each device or server that missed its ring, the owner, the reason and the date it will be fixed. Review it in the same meeting each month. If a system stays on the list for two cycles in a row, escalate it.
The same inventory and report also help responders scope a problem faster if something does go wrong. Containment should start promptly once you understand what you are dealing with, with evidence capture running in parallel.
Message us to talk through your patching plan.
Sources
Discover more from Core-Infosec
Subscribe to get the latest posts sent to your email.
