How can you patch systems during an incident response without creating more risks?

1 Assess the situation

Before you apply any patches, you need to understand the scope and impact of the incident. What systems are affected? What vulnerabilities are exploited? What are the indicators of compromise? How severe is the threat? You can use various tools and techniques, such as network monitoring, log analysis, vulnerability scanning, and threat intelligence, to gather this information. Based on your assessment, you can prioritize the most critical systems and patches, and decide when and how to apply them.

3 Apply the patches

Once you have planned the patching, you can apply the patches to the systems. Depending on the situation, manual, automated, or remote patching may be used. It is important to verify the source and integrity of the patches, making sure they come from trusted vendors or sources and checking their signatures or hashes. Patches should be applied in stages; begin with a small group of systems or a test environment, and monitor the results. If there are no issues, proceed to a larger group or a production environment. If any issues arise, roll back the patches and troubleshoot. After applying the patches, validate that they have fixed the vulnerabilities and improved the security of the systems. Tools such as vulnerability scanners, penetration testers, or checksums can be used for this purpose.

4 Monitor the systems

After applying the patches, you need to monitor the systems for any changes or anomalies, such as whether the patches have resolved the vulnerabilities and prevented further exploitation or damage, or if they have caused new ones. You should also be aware of any side effects, such as errors, slowdowns, or crashes that the users may experience. Additionally, it is important to update your inventory, configuration, and documentation records to reflect the patching status of the systems.

5 Review the patching

The final step of patching systems during an incident response is to review the patching process and outcomes. You should evaluate the effectiveness, efficiency, and improvement of the patching process. Specifically, you should consider how well the patching addressed the vulnerabilities and mitigated the risks, how fast and easy it was to complete, and what lessons learned or best practices can be identified for future incidents. Additionally, you should document and report the patching results and findings, incorporating them into your incident response plan and strategy.

6 Here’s what else to consider

This is a space to share examples, stories, or insights that don’t fit into any of the previous sections. What else would you like to add?