Security
Patching is boring, and that is the point
A repeatable patch process beats any security product an agency could buy.
Most exploited vulnerabilities have had a patch available for months. Agencies get breached not by novel attacks but by known weaknesses that nobody got around to fixing. A patch process is unglamorous and is the highest-return security work after multi-factor authentication.
What a working process looks like
Inventory. You cannot patch what you do not know you have. Every server, workstation, network device, and application, with an owner.
Cadence. Workstations patch automatically within days. Servers patch on a monthly cycle with a defined window. Critical, actively exploited vulnerabilities get an emergency path measured in days, not weeks.
Testing. A small pilot group receives patches first. Problems are caught before the fleet.
Exceptions. Systems that cannot be patched, such as a controller for a water plant running an old operating system, are documented, isolated, and reviewed on a schedule. An exception without compensating controls is a hole.
Measurement. Percentage of assets patched within the target window, reported monthly. The number should be boring.
The tools
Device management platforms handle workstations. Configuration management or the cloud provider's patch service handles servers. Vulnerability scanners verify. None of this is expensive.
The hard part
Applications from vendors that lag behind operating system patches. Legacy systems nobody dares touch. Change windows that departments resist. These are governance problems, and they are solved by leadership setting the expectation that patching is not optional.
We build patch processes into every environment we deliver and report on them in every support agreement. It is the least exciting part of the work and among the most important.