There are two approaches to consider when it comes to patch management: On-premise and cloud-based.
On-premise patch management is a legacy technology that relies on servers and a substantial amount of manual labor to implement and maintain. On-premise solutions, such as WSUS or SCCM, often carry hidden cost burdens and may not even meet all of an organization’s needs. It is not uncommon for organizations to need multiple on-premise tools to manage patches for different operating systems and third-party applications. On-premise patching tools are also extremely limited when it comes to managing remote devices, and reliance on VPN can be troublesome.
There is a substantial amount of labor and time involved with nearly every aspect of on-premise patching solutions. From implementation to maintenance, these legacy patching options are a huge drain on personnel resources, and to put it simply, on-premise patch management makes the entire process of patching more cumbersome and reduces patch deployment speed -- a critical element of cyber hygiene best practices.
Cloud-based patch management is a newer option and is part of the SaaS adoption movement. In patch management, cloud-based tools are making cyber hygiene best practices more accessible and less complicated to implement. With a cloud-based patching platform, organizations can deploy patches across an entire network in just a few clicks. Along with faster patching speeds, modern patching solutions can offer significant cost savings as compared to legacy, on-premise patch management platforms. With cloud-based patch management, organizations can see cost reductions of up to 80 percent, and ditch soul-sucking on-premise solutions for good.
Why is speed critical to patch management?
Being able to respond to cyber threats fast enough is the new urgency in today’s digital landscape. On average, there are 22,000 new vulnerabilities disclosed annually -- that means there are about 60 new vulnerabilities revealed every day. Of these, 33 percent are rated critical. There are literally thousands of critical vulnerabilities that need to be addressed. Sluggish legacy infrastructure makes it nearly impossible for organizations to keep up with their patching workloads -- let alone get ahead of threats.
Once a vulnerability is disclosed and a patch is released, the race to secure your systems begins. While security updates provide IT and SecOps staff with details on new exposures and resolving vulnerabilities, this information also gives attackers a specific focal point and code base to start fuzzing.
The average time it takes an attacker to weaponize a known vulnerability is seven days, with many exploits occurring inside that window. Conversely, organizations take an average time of 102 days to deploy just one patch. Organizations that ignore this discrepancy are playing a game of Russian Roulette and at the current patching rate, there is a one-in-four chance that a known vulnerability will be exploited before a security update is deployed.
The clock starts ticking at the moment of disclosure, and attackers can be ready to start deploying new exploit techniques within seven days, often less. Meanwhile, survey data suggests that 31 percent of organizations will take over 6 months just to test and deploy a new patch. This is a huge window of opportunity for malicious actors. While it is true that legacy, on-premise patching solutions make the job of patching a time-consuming and arduous endeavor, they are not the only option for hardening systems anymore.
Deploying patches six months after they’ve been released has little to no pre-incursion value. Patches need to be applied quickly in order to be effective. While many organizations may think they are taking a “calculated risk” when they put off patching, the reality is that resolving vulnerabilities is a critical element of cyber hygiene and endpoint protection best practices.
As regulations for cybersecurity become the norm, organizations may find themselves in hot water if they do not adapt. Recent compliances from HIPAA and PCI are stipulating that security updates should be performed within 30 days of release, and these new standards are expected to be met by the organizations who need to follow these compliances.
However, 30 days is still too long to go unpatched. For cyber hygiene best practices, organizations should be working towards a 72-hour mean time-to-hardening objective and a 24-hour threshold for patching zero-day vulnerabilities. The 24/72 hardening threshold is critical to effectively realizing a pre-incursion defense strategy. Outside of this window, hardening efforts become reactive exercises.
There are many reasons why organizations are not able to patch their systems in a more timely manner with legacy, on-premise patching solutions. Legacy products are not well-equipped for handling the needs of the modern workplace; even the most basic elements of endpoint security and patch management are difficult to accomplish with legacy patch management platforms, such as WSUS. Overcomplexity in legacy patching protocols can make it hard for IT staff to patch fast enough, especially when concerns about disrupting business operations are high.
Remote work and endpoint security
In recent times, there has been a swift and dramatic shift to remote work -- and many organizations say they plan on adopting these changes in their workforce long-term. Ensuring that remote employees can be productive is a priority for most organizations and many have tried to make the switch from in-house to remote as quickly as possible. However, rapid changes to any organization’s infrastructure can leave holes in their security and highlight the glaring problems of legacy technology. This is especially true when it comes to the management of remote endpoints.
Remote endpoints are just as vulnerable to attack as your on-site devices, if not more so. On-site devices will at least have the additional protection of a corporate firewall; remote devices are typically going to be connected to non-corporate networks. However, many organizations struggle with managing and hardening their remote endpoints.
Survey data shows that 90 percent of IT professionals believe remote endpoints are a security risk. Another 38 percent report that a remote employee was the cause of a security incident.
With legacy, on-premise patch management, there are a few factors that can impede the security of an organization’s remote devices. Remote work and endpoint security should go hand-in-hand, but reliance on outdated technology makes it nearly impossible for organizations to adequately protect their remote devices.
Legacy patch management strikes out with remote endpoints
With legacy patch management tools, such as WSUS, remote endpoint visibility is nil. Lack of visibility means that IT teams cannot use these tools to assess the success of patch deployment. Perhaps that’s why 80 percent of CISOs and CIOs say they were shocked to find patches they thought had deployed across their entire network actually hadn’t. Ultimately, poor endpoint visibility limits an organization’s ability to detect and remediate threats. Sixty percent of data breaches involve a known vulnerability with an available patch. Unpatched vulnerabilities on remote endpoints can easily go unresolved due to the lack of visibility and control offered by legacy, on-premise patch management platforms.
Traditional patching solutions also rely on VPN usage to deploy patches. This means the onus is on the remote employee to connect to the VPN and receive updates -- which may or may not happen in a timely manner. Many organizations have experienced a rapid influx of remote employees and this surge can put your VPN’s bandwidth to the test. Slow VPN speeds may frustrate remote workers to the point where they skip connecting entirely, which means critical security updates are not reaching their devices.
Today, more endpoints are going remote than ever before -- and each one of these devices needs to be secured against potential threats. The previous generation of patch management was a step-up from manual patching, but it is simply not equipped to handle the needs of more current infrastructure.
Modern, cloud-native patch management tools, like Automox, give users full endpoint visibility across all devices, no matter where they are located.
SaaS adoption: How cloud-based technology can cut costs
Legacy patch management technology comes with an array of hidden costs, not the least of which is time. There’s time spent on tracking, prioritizing, scripting, testing and deploying security updates, server maintenance and power usage, and many of these tools are single-use. This means a single organization may need multiple patching tools to meet their needs, and each one of those tools will require time spent on user education, configuration and maintenance. Some products require upwards of 40 hours of training per employee.
Customer survey data also suggests that organizations spend 38 hours per week just on the process of deploying patches with legacy approaches. There are also many painful hours spent on configuration and maintenance for on-premise equipment. Organizations with multiple geographic locations may find that tasks need to be repeated for each and every location. This is all time and money that could be spent elsewhere. In an environment of 1500 endpoints and 50 servers across multiple locations, with 5 employees dedicated to endpoint hardening, organizations may be looking up to a total cost burden in excess of $295,000 in just the first year
Even with all the time and money that gets invested into legacy patching infrastructure, 74 percent of organizations say they can’t patch fast enough because they don’t have enough employees.There is a huge employee shortage in IT and 64 percent of organizations say they are looking to hire more dedicated resources for patching. The tedious, costly and inefficient nature of legacy solutions has become a regrettable standard in patch management. However, SaaS adoption provides a novel solution to both the exorbitant costs and lost time spent on legacy infrastructure.
Cloud-based patch management platforms eliminate the hassle and cut the costs associated with legacy, on-premise solutions. In the hypothetical 1500-device environment, implementing a cloud-based patching solution like Automox can yield $190,000 in cost reductions. Considering a SaaS adoption strategy for endpoint hardening eliminates the need for on-premise equipment and VPNs, and cuts out repetition in your patch management routine. With a modern, cloud-based solution, administrators no longer need multiple consoles and agents to handle patching alternative operating systems and third-party applications. New approaches to patching do away with manually-driven workflows and provide users with necessary accessibility to the basics of endpoint security and cyber hygiene.
Cloud-native, automated patching platforms give users access to the basics of hardening from a single pane of glass. Whether you’re taking inventory of devices and software, deploying new patches or checking the status of remote endpoints, it can all be done from the same console. With a tool like Automox, updates can be performed across networks with multiple geographic locations at the same time, preventing unnecessary repetition in your patching routine. Adopting a modern, SaaS-based patching solution can help organizations save their time, money and sanity.
Consider automated, cloud-based patch management solutions
Modern, cloud-based patch management solutions offer a novel approach to the growing problems seen with legacy patch management. Automated patching solutions can help organizations eliminate much of the redundancy in their patching workflows and increase their patching confidence.
The digital landscape is evolving, but legacy options for patch management have not kept pace. Today, many organizations are relying on an array of operating systems and third-party applications to meet their needs, and the remote workforce is growing steadily; all are part of an organization’s attack surface and need to be protected.
Legacy patch management systems are often single-use tools and are not well-equipped to meet the needs of modern, diverse infrastructure. Patching alternative OS and third-party apps with legacy equipment often requires tricky configurations, if it’s even possible. In many cases, organizations end up needing multiple tools to handle their patching workloads, which can contribute to overcomplexity in your patching workload. Managing remote endpoint security with legacy technology is equally difficult. Not only are on-premise patching solutions notoriously unreliable for endpoint visibility, these options rely on VPNs for managing remote devices -- which can come with its own issues.In many cases, these options do not scale well and may struggle to handle a larger workforce. More, if an organization has multiple geographic locations, many of the tasks associated with patching may have to be replicated several times across each region.
Cloud-native, automated patch management platforms like Automox resolve these inefficiencies and give users the visibility and control they need to harden endpoints successfully. Designed with diverse infrastructure in mind, users can patch multiple operating systems and third-party applications from a single interface -- eliminating the need for multiple tools, scripting languages and much of the manual workflow associated with patching. Instead, every piece of equipment on your network is treated exactly the same and patches can be deployed across all devices with just a few clicks. Once a patch is deployed, full endpoint visibility capabilities allow users to see which patches were successful and take immediate action to remediate vulnerabilities as needed. In addition to reducing complexity in patch management routines, cloud-based patching solutions are accessible to organizations of every size. Going with the cloud can help organizations cut costs, increase efficiency and boost their patching confidence.
About Automox Automated Patch Management
Facing growing threats and a rapidly expanding attack surface, understaffed and alert-fatigued organizations need more efficient ways to eliminate their exposure to vulnerabilities. Automox is a modern cyber hygiene platform that closes the aperture of attack by more than 80% with just half the effort of traditional solutions.
Cloud-native and globally available, Automox enforces OS & third-party patch management, security configurations, and custom scripting across Windows, macOS, and Linux from a single intuitive console. IT and SecOps can quickly gain control and share visibility of on-prem, remote and virtual endpoints without the need to deploy costly infrastructure.
Experience modern, cloud-native patch management today with a 15-day free trial of Automox and start recapturing more than half the time you're currently spending on managing your attack surface. Automox dramatically reduces corporate risk while raising operational efficiency to deliver best-in-class security outcomes, faster and with fewer resources.
