Timely Software Patching isMore Important Than Ever
Updates and fixes are still a necessity to keeping systems
secure and efficient

Software patching has for years been one of those tedious, and sometimes angst filled, processes thatare simply part of the job. Just about every software company now issues patches and updates for their products
in order to keep software secure and efficient. It is integral to the operation of software.

But patching, while necessary, is often a challenge for organizations because of the high volume of patches released
daily and monthly. Some cloud vendors are recommending that rather than patching, organizations should instead
fix the image and redeploy in order to update server instances. We reached out to IDG influencers to get theirperspective on whether patching was dead or alive and how they think business should handle the process today.

“Software patching is both very much alive, and unlikely tomeet its demise anytime soon. If anything, with software
now handling more of our world than ever before, and morebusiness value residing in data, the importance of software
patching has never been greater.”
MICHAEL SKAFF (@mskaff)
CIO for Jewish Senior Living Group

Adam Stein thinks patching is an important part of IT
operations that isn’t going away. “ Software patching is aliveand kicking to the tune of nearly $1 billion (USD) annually overthe next four years,” he says. “This is due to most SaaS andon-premises software application vendors underspending onsecurity, functional and UX testing, even with client’s increasing
sensitivity to the costs of compliance breaches and confidential
information theft.”“This leaves a tremendous patch requirement gap innearly every IT industry, including enterprise apps, IoT,
and semiconductors,” he continues. “The recent Spectre
semiconductor software vulnerability debacle shows that large
gap. Essentially all major computer and mobile chips wereaffected by the Spectre flaw. Every chip customer, including
consumer device manufacturers, will require a software patch
to block this potent attack vector.”
ADAM STEIN (@apstein2)
Principal at APS Marketing, Inc.

2 Timely Software Patching is More Important Than Ever

Security Makes Patching EssentialThe recent Spectre flaw is a good example of the kind of risk-based issues that regularly prompt the need for patches to be pushed out anddeployed quickly.

“With cybercrime rising strongly and massive vulnerabilities
being continuously found, software patching remains the best
option to safeguard the integrity of our systems and, again,that involves business-critical applications, too.”
SAMUEL PAVIN (@sampavin)
Brand Strategist and Director
Samuel Pavin Group Ltd.

Mike D. Kail would agree. “ Implementing best practices aroundcode and application hygiene is paramount to overall security.”
MIKE D. KAIL (@mdkail)
CTO, Cybric

Jake Williams says the challenges around keeping up withpatch schedules mean other factors need to be part of strategy
in the event that patching doesn’t happen when it should.
“ Today we’ve matured quite a bit and understand that we’ll
never get to 100% patch compliance in any moderately sizedorganization,” he says. “Accordingly, organizations need tocomplement patching with additional controls such as device
inventory and software inventory to build a truly comprehensive
security program.”
JAKE WILLIAMS (@MalwareJake)
President, Rendition Infosec

Who is Responsible?
It’s clear patching is essential to address flaws and keep software secure — but many noted the process to release and deploy patches is changing.

““Software patching is still much alive. The responsibilities for
it are shifting. In the cloud-based, serverless, and container
paradigm, we rely on providers to handle host patching while
we focus on patching the libraries and tools we use. I am a fanof this shift because providing useful, secure, and stable apps
for end users can be challenging enough for a team. That shared
responsibility really means letting the domain experts handle
what they do best.”
KEVIN FELICHKO (@kfelichko)
CTO, statUP

Software patching is not dead — as long as software is being
written, it will need to be patched. However, where the patches
are done and by whom may change. As more apps/software
move to [the] cloud, the patches will be more invisible andautomatic, and much more transparent to end users.”
JACK GOLD (@jckgld)
Principal Analyst, J. Gold Associates, LLC

BMC’s BladeLogic Server Automation ensures
timely analysis, scheduling, delivery, andinstallation of patches to reduce overall risk. Contact BMC
today to learn how BladeLogic Server Automation canhelp secure and manage your server environment.

TOM CONKLIN, Head of Security and Compliance at Vera Security,weighed in via LinkedIn and says although the idea of a “Microsoft PatchTuesday” process is out of date, new processes that release fixes on amore timely schedule are the future of patching.

“ Software patching in the traditional sense that vendors like Microsoft
can release patches on a regular cadence [like] Patch Tuesday is dead,”says Conklin. “This doesn’t mean patching is dead, but that we cannotplan for periodic structured patch releases. There are too many thirdparty libraries and frameworks in software today to limit patching to aschedule that a vendor can control.”“If a critical vulnerability is discovered in a software library, vendorsthat are vulnerable need to fix their applications as soon as possible
and release the patch to their customers as soon as they can,” Conklin
also notes. “Otherwise this leaves the customer vulnerable with noway to update their software.”“Meanwhile,” he continues, “the bad actors know about the vulnerability
and can start devising ways to look for vulnerable applications andexploit the vulnerability. If anything, we will see patching more
frequently and companies need to focus on how they will support
rapid patching across their infrastructure.”
At the end of the day, timely, automated patching means reduced riskof security exposure, a lower cost of managing servers, and faster
response to immediate threats. For that reason, it’s clear that not only
is software patching not dead, but timely software patching is more
important than ever.