Getting started with software updates
This is one of those topics that looks small until it costs you something. A short on-ramp to software updates for teams who have not touched it before.
The cheapest security work is the boring kind done on a schedule. It is the sort of thing that looks like polish right up until it costs you an enquiry.
Why this earns attention
Most breaches exploit a fix that already existed. This is the sort of thing that compounds, quietly, in both directions. If two people in the business would answer this differently, that gap is the actual problem.
Your first week
- Find out what is already in place
- Schedule updates rather than reacting to incidents
- Change one thing and measure it
Staging first prevents the update becoming the outage. Where this goes wrong is almost never a lack of knowledge. The practical test is whether someone new to the project could tell, in a minute, that it had been handled.
What this looks like day to day
Security is a maintenance habit rather than a purchase, which is why it drifts. Three things worth confirming about software updates before you move on:
- Someone can say what the current setup is without going to look
- Schedule updates rather than reacting to incidents — and you know whether that is true here
- There is a way to tell whether the last change to this helped
If you are not sure where your systems currently stand on this, it takes us about an hour to find out.