I was speaking to a trades business owner recently about cyber security. He assumed hackers spent their days creating sophisticated attacks that only affected large organisations.
I asked him a simple question: “If you were a thief, would you spend hours trying to break into a locked van, or would you walk down the street looking for one that had been left unlocked?”
His answer came immediately: “The unlocked one.”
Cyber criminals think exactly the same way.
Many of the largest cyber attacks in recent years have not involved groundbreaking techniques or secret vulnerabilities. They have involved known weaknesses that already had fixes available. The latest Orange Security Navigator report highlights several major state-backed attacks where attackers exploited vulnerabilities that had already been publicly disclosed and patched.
The cyber equivalent of leaving your van unlocked is leaving systems unpatched.
Why do old vulnerabilities still work?
It sounds strange. If a vulnerability is known and a patch exists, surely everyone installs it?
Unfortunately, real businesses do not operate in a perfect world.
Updates get postponed because:
- People are busy
- Nobody knows who is responsible
- Older software might stop working
- Devices are missed
- Remote workers are overlooked
- Nobody has a complete list of assets
One missed laptop.
One forgotten server.
One firewall that has not been updated for months.
That can be enough.
Attackers know this.
They scan the internet continuously looking for systems that are running outdated software. They are not choosing victims one at a time. They are looking for easy opportunities at scale.
The attackers are not always using zero-day vulnerabilities
When cyber attacks make the news, the headlines often focus on exotic sounding terms like “zero-day vulnerabilities”.
The reality is often less dramatic.
Many successful attacks use vulnerabilities that have been known about for weeks, months or even years.
The Security Navigator report highlights the Salt Typhoon campaign, where attackers exploited vulnerabilities in network devices including VPN gateways, routers and firewalls. The vulnerabilities were known and patches were available.
That should be reassuring.
It means many attacks are preventable.
The challenge is not knowing what to do. The challenge is consistently doing it.
You cannot patch what you cannot see
One of the biggest problems we encounter is asset visibility.
Ask many organisations how many devices they have and the answer is often a rough estimate.
Ask which software is installed across every device and the answer becomes even less certain.
Cyber criminals do not need a complete picture. They only need one forgotten device.
That is why patch management starts with knowing what you own.
Every laptop, desktop, server and application should be accounted for.
Supported software matters
We still come across organisations running software that is no longer supported.
The thinking is usually: “It still works.”
The problem is that unsupported software stops receiving security updates.
When vulnerabilities are discovered, there may be no fix coming.
At that point you are relying on luck.
Windows 10 reaching end of support is a good example. Once software reaches end of life, the risk increases because vulnerabilities continue to be discovered but security updates become limited or unavailable.
Supported software is not an exciting cyber security control, but it is one of the most important.
Why Cyber Essentials focuses so heavily on updates
Some people view Cyber Essentials as a paperwork exercise. It isn’t.
Several of the controls exist because they address the most common ways attackers gain access.
Keeping systems patched.
Removing unsupported software.
Restricting administrative access.
Using supported operating systems.
These controls are not there because they sound good. They are there because they work.
Many of the attacks we read about every week would have been significantly harder if these fundamentals had been in place.
Making patch management easier
The challenge for many small businesses is time.
Manually checking every device is unrealistic.
That is why automated patch management tools have become so important.
Action1
Action1 helps organisations identify missing patches, unsupported software and vulnerable systems from a central dashboard.
It removes much of the manual effort involved in keeping devices updated and provides visibility that many businesses currently lack.
Heimdal Patch & Asset Management
Heimdal combines patch management with asset visibility.
It helps organisations identify devices, deploy updates and reduce the risk created by missing patches or forgotten software.
The benefit is not just patching. It is knowing what exists in the first place.
The real goal is risk reduction
Patching is not about achieving perfection.
No organisation patches every vulnerability instantly.
The goal is reducing the number of easy opportunities available to attackers.
Think back to the unlocked van.
You cannot stop every thief from walking down the street.
You can stop them choosing your van.
The same principle applies to cyber security.
Most attackers are looking for the easiest route in.
The fewer opportunities you leave available, the less attractive your organisation becomes.
Questions Worth Asking Today
- Do we know every device connected to our business?
- Are all devices receiving security updates?
- Are we running unsupported software?
- How quickly are critical patches applied?
- Could we prove this if an insurer, auditor or customer asked?
If you are unsure of the answer to any of those questions, a patch management review is a sensible place to start.
Cyber security is often portrayed as complicated.
Sometimes it is.
Sometimes it is simply making sure the doors are locked before you leave for the day.
