This security wiki provides guidelines for effective security update management to ensure that your organisation's devices and software remain protected against known vulnerabilities. Follow the recommendations below to establish a robust security update management process.

A6.1. Operating System Support:

Indicate whether all operating systems on your devices are supported by a vendor that regularly releases security updates. Answer "yes" or "no" to confirm the availability of regular security updates for your operating systems.

A6.2. Software Support:

Confirm whether all software on your devices is supported by a supplier that provides regular fixes for security issues. Answer "yes" or "no" to ensure that all software used within your organisation benefits from timely security updates.

A6.2.1. Internet Browsers:

List all internet browsers installed on your devices, along with their respective versions. This information helps ensure that your browsers are up to date with the latest security patches.

A6.2.2. Malware Protection Software:

Provide a list of all malware protection software used on your devices, including their versions. This information ensures that your malware protection tools remain updated to address the latest threats.

A6.2.3. Email Applications:

List all email applications installed on end-user devices and servers, along with their versions. This helps maintain the security of your email systems by ensuring that they receive relevant security updates.

A6.2.4. Office Applications:

Provide a list of all office applications used to create organisational data, including their versions. This information ensures that your office applications are updated to address any security vulnerabilities.

A6.3. Software Licensing:

Confirm whether all software used by your organisation is properly licensed, following the recommendations provided by the software publishers. Answer "yes" or "no" to ensure compliance with licensing requirements.

A6.4. High-risk or Critical Security Updates (Operating Systems and Firmware):

Indicate whether all high-risk or critical security updates for operating systems, router firmware, and firewall firmware are installed within 14 days of release. Answer "yes" or "no" to ensure timely patching of critical vulnerabilities.

A6.4.1. Operating System Auto-updates:

Answer "yes" or "no" to indicate whether auto-updates are enabled for operating systems, facilitating the automatic installation of security updates.

A6.4.2. Manual Updates Process:

Describe the process you follow to ensure that high-risk or critical security updates for operating systems and firmware on firewalls and routers are applied within 14 days of release when auto-updates are not enabled.

A6.5. High-risk or Critical Security Updates (Applications and Associated Files):

Confirm whether all high-risk or critical security updates for applications, associated files, and plugins (e.g., Java, Adobe Reader, .NET) are installed within 14 days of release. Answer "yes" or "no" to ensure prompt patching of critical vulnerabilities.

A6.5.1. Application Auto-updates:

Answer "yes" or "no" to indicate whether auto-updates are enabled for applications, allowing automatic installation of security updates.

A6.5.2. Manual Updates Process:

Describe the process you follow to ensure that high-risk or critical security updates for applications are applied within 14 days of release when auto-updates are not enabled.

A6.6. Removal of Unsupported Software:

Indicate whether you have removed any unsupported software from your devices that no longer receives regular security updates. Answer "yes" or "no" to ensure the removal of vulnerable software.

A6.7. Handling Unsupported Software:

Explain how you manage unsupported software necessary for your business needs and ensure it is out of the scope of the assessment. Describe any measures taken to isolate unsupported software from the rest of the network to minimise associated risks.

Implementing effective security update management practices helps protect your organisation's devices and software from known vulnerabilities. Regularly updating operating systems, applications, and associated components is crucial to maintaining a secure IT infrastructure and mitigating the risk of exploitation by malicious actors.

Note: The information provided above is based on general security practices. Organisations should adapt these guidelines to align with their specific requirements and consult with cybersecurity professionals for tailored advice related to security update management.

Find out more about Periculo Cyber Essentials or contact us

‍