If you own a computer, it is very likely you know something about patching, or updating, software. First, this is different from upgrading, which usually means a developer of software has added new features or made significant changes to the application.
Essentially, the term patch comes from the idea of closing a weakness, or hole in software, that allows an attacker to take action they should not. These are discovered either by an outsider or the developer of the software. The patch is designed to modify the application in order to close the hole—otherwise known as a vulnerability—or to fix bugs and/or errors.
Why do we care about closing these vulnerabilities? We care because software vulnerability is a leading attack vector, and yet one of the simplest to secure. According to recent study by Fortinet, 90% of attacks leveraged vulnerabilities that were known for three or more years, and 60% for 10 years. In Verizon’s 2018 Data Breach Investigations Report, they reported 99.9% of exploited vulnerabilities were known for more than one year before an attack. It is essential to close these vulnerabilities at home, as well as in your business.
Many individuals and organizations do a very poor job of keeping up on patching and, as a result, leaving themselves exposed. I can speak from experience, as we at Alvaka Networks patch thousands of servers and desktops for corporations every month. While the application of patches is straightforward, if delayed, done poorly, or without proper consideration of back-up, application corruption, post patch testing and other issues, serious damage and business interruption can occur.
So, get to work closing those gateways to malware and hackers…PATCH, PATCH, PATCH!!!
Kevin McDonald, COO & CISO – Alvaka Networks
Kevin B. McDonald is the chief operating officer and chief information security officer at Alvaka Networks. Kevin is a trusted technology and security practitioner and public policy advisor to some of America’s most influential people and organizations. He advises corporate executives, federal and state legislators, law enforcement, high net worth individuals and other business leaders. He is a sought after consultant, writer, presenter and trainer on the issues surrounding personal, physical and cyber security, compliance and advanced technology. Kevin has written for and been interviewed by dozens of national publications and on major television, radio and digital outlets.
Chairman, Orange County Sheriff/Coroner’s Technology Advisory Council (T.A.C)
Member, OC Shield
Member, FBI InfraGard
Member, O.C. Homeland Security Advisory Council (OCHSAC)
Member, US Secret Service’s LA Electronic Crimes Task Force (LAECTF)
Smoke testing is a term used to describe the testing process for servers after patches are applied. 
Estimating an average time for patching servers and PCs can be a bit tricky. It can vary from one month to the next, depending upon the number and complexity of the patches released by your software vendors. You must consider all versions of operating systems and have a complete inventory of all your application software to do this job correctly. Our experience has shown that manual patching of systems takes on average of about 1.5 hours each.
This is a basic cost calculator for you to compute your typical monthly cost for patching your servers, PCs, laptops, tablets and associated application software. It also forms the basis for you to begin calculating your Return on Investment for software patching, or for comparison with alternatives to the manual process of patching operating systems and application software—such as Patch Management as a Service, also known as Vulnerability Management as a Service.