Ignoring patch updates while working remote? This could be a costly mistake, warns Action1

IDG, in one of its cybersecurity based reports, revealed that 60% of breaches involved vulnerabilities for which a patch was available but not applied. It came to light that vulnerabilities have to be patched timely enough because the time window between the exposure and fix was long enough for a cyberattack.

Existing on-premise tools, like Microsoft’s WSUS or 3^rd party patching systems, worked well enough – until the massive switch to remote work, which happened because of COVID-19’s social distancing protocols came into effect.

When people took their laptops to work from home, patching literally came to a halt, because the corporate update deployment systems were simply not designed for computers located outside of a corporate security perimeter. Some of these systems might still work if the users connect to the company’s VPN, but unfortunately, the multitude of issues with VPN made it seem like a very unpopular technology in many organizations.

One of the really alarming aspects of security breaches is that hackers continued to take advantage of existing exploits that were long resolved by the security vendors. What was found is that these cybercriminals need not really be advanced or highly skilled in order to execute complex cyberattacks. Ignoring patch updates was enough for the breach and also the low skill requirement made it possible for entry-level cybercriminals to execute their devious acts.

Jonathan Jervell, Sr. Systems Administrator from Stealth Partner Group says that with the COVID work-from-home requirements, organizations are looking at methods to deploy Microsoft and third-party updates, such as updates for Adobe products. Jervell observes that his company cannot rely on the user base to connect with the corporate VPN. A reliable method is needed to manage these systems.

Observing this security need, Action1 Corporation has implemented a fully cloud-based patch management service to control both Windows and 3^rd party app updates in a unified way, with common workflows, prioritization of updates, deployment time windows, and other benefits of a full-featured patch management system.

Alex Vovk, CEO of endpoint security solution provider Action1 Corporation, is in the opinion that existing on-premise tools, such as WSUS or built-in Windows Update simply stopped working as intended when employees took their laptops home. At the same time, cybercriminals exploiting unpatched systems only intensified their attacks. He believes that organizations using Action1 products can take back control and ensure that all users, in all locations, are adequately protected from cyberattacks.

Vovk is in the opinion that organizations using Action1 can now enforce the same standard procedures and timelines of security patching for remote employees working from home, as well as office-based employees.

According to Vovk the advantages of these patch updates are plenty. First, information about all missing updates is consolidated in real-time, from all locations, including home-based employee devices not connected to corporate VPN. Second, an updated approval workflow allows organizations to prioritize updates based on security severity. And third, custom maintenance time windows prevent disruption of users during business hours, while forcing timely update deployment and automatic reboots when required.

So, it is implied that network-independent, cloud-based patch management systems are a viable option when it comes to timely patching devices of remote employees. Since organizations are looking to unify their patching processes, for both remote and corporate users, it brings a cloud-based approach to the forefront of patch management technology.