How to get software updates right
We end up explaining this on discovery calls often enough that it deserved writing down. The short answer to software updates is that it is mostly a sequence of small decisions, not one big one.
Security is a maintenance habit rather than a purchase, which is why it drifts. The version that survives contact with a real deadline is the simple one.
What it costs to ignore
Most breaches exploit a fix that already existed. Small and consistent beats large and occasional here. Doing this properly once is usually cheaper than doing it approximately three times.
The steps
- Establish what you have today before changing anything
- Schedule updates rather than reacting to incidents
- Staging first prevents the update becoming the outage
- Write down the decision so the next person does not re-litigate it
Staging first prevents the update becoming the outage. This is the sort of thing that compounds, quietly, in both directions. The version that survives contact with a real deadline is the simple one.
Making it stick
In practice
The cheapest security work is the boring kind done on a schedule. Three things worth confirming about software updates before you move on:
- Someone can say what the current setup is without going to look
- Most breaches exploit a fix that already existed — and you know whether that is true here
- There is a way to tell whether the last change to this helped
Worth checking on your own setup before it becomes someone else's problem to fix.