patch management

Patch management is defined as a sub-practice of various disciplines including vulnerability management (part of security management), lifecycle management (with further possible sub-classification into application lifecycle management and release management), change management, and systems management. The practice is broadly concerned with the identification, acquisition, distribution, and installation of patches to systems. Some definitions of patch management are as a software-level practice,{{cite web |url=https://www.rapid7.com/fundamentals/patch-management/ |publisher=Rapid7 |title=Patch Management: Definition & Best Practices |access-date=15 July 2024}} while others are as a systems-level process: software, drivers, and firmware.{{cite web |url=https://www.intel.com/content/www/us/en/business/enterprise-computers/resources/patch-management.html |title=What Is Patch Management? |publisher=Intel |access-date=15 July 2024}}{{cite web |url=https://www.techtarget.com/searchenterprisedesktop/definition/patch-management |title=

What is patch management? Lifecycle, benefits and best practices |author1=David Essex |author2=Brien Posey |publisher=TechTarget |access-date=15 July 2024}}{{cite web |url=https://www.ibm.com/topics/patch-management |title=What is patch management? |date=20 December 2022 |publisher=IBM |access-date=15 July 2024}}

While reserving time for patching takes up enterprise resources, there are balancing factors which can make proper patch management into a net productivity boost for an organization. Up-to-date systems often perform more efficiently, less costly, with less errors, less security risks, and better user workflow. Additionally, compliance with changing local and federal regulations are more likely to be satisfied.

Patches can be used to defend against and eliminate potential vulnerabilities of a system, so that no threats may exploit them; therefore, patch management can be considered a sub-discipline of vulnerability management. Effective patch management is an essential element of a broader vulnerability management lifecycle, which involves continuous processes of identifying, evaluating, prioritizing, and remediating security weaknesses across systems and applications.{{Cite web |title=What is vulnerability management? A complete guide {{!}} NordStellar |url=https://nordstellar.com/blog/vulnerability-management/ |access-date=2025-04-15 |website=nordstellar.com |language=en}} Every patchable device in a system presents an attack surface that must be secured.

There are a multitude of problems that can arise during patch management. A common issue is buggy patches, which either fail to fix their problem or introduce new issues. Another issue is deployment synchronization, since various subsystems may receive instructions to update at different times. Similarly, the difficulty of patch management across many devices may grow at an uncontrollable rate depending on organizational size.

One prominent demonstration of the challenges facing proper patch management was the buggy Falcon Sensor patch by CrowdStrike which caused one of the worst IT outages of all time.{{cite web |last1=Milmo |first1=Dan |last2=Kollewe |first2=Julia |last3=Quinn |first3=Ben |last4=Taylor |first4=Josh |last5=Ibrahim |first5=Mimi |title='Largest IT outage in history' hits Microsoft Windows and causes global chaos |url=https://www.theguardian.com/australia-news/article/2024/jul/19/microsoft-windows-pcs-outage-blue-screen-of-death |website=The Guardian |access-date=19 July 2024 |date=19 July 2024}}

{{See also|:Category:Patch utilities |:Category:Software update managers}}

A patch management tool (alternatively patch manager, patch management system, patch management software, or centralized patch management) help orchestrate all of the procedures involved in patch management. Tools can be in-house (applied locally by local administrators), or external, as with managed service providers (applied externally by a provider).

• Intel Active Management Technology, used with Intel vPro technologies, has features like scheduling, upgrade verification, and remote management; implementing patches along with unified endpoint management.
• Windows Update for Business, System Center Configuration Manager, and Windows Server Update Services offer control over patch deployment, with features enabling testing, scheduling updates, and setting custom configurations on Windows platforms.{{cite web |url=https://purplesec.us/learn/windows-patch-management |title= Windows Patch Management Best Practices For 2023 |last=Firch |first=Jason |date=30 March 2023 |publisher=PurpleSec |access-date=15 July 2024}}

{{main article|Managed service provider}}

• ManageEngine Patch Manager
• SolarWinds Patch Manager
• Automox
• Atera
• Kaseya VSA

{{reflist}}

{{Computer security}}

{{DEFAULTSORT:Patch management}}

Category:Information technology management

Category:Configuration management

Category:System administration