Go ahead and ignore Patch Tuesday – it might improve your security
- Reference: 1747225146
- News link: https://www.theregister.co.uk/2025/05/14/improve_patching_strategies/
- Source link:
That's the opinion of Craig Lawson, a Research Vice President at analyst Gartner, who on Wednesday told the firm's Infrastructure, Operations & Cloud Strategies Conference: "Nobody has ever out-patched threat actors at scale."
We are not in the age of industrialized vulnerability exploitation
Lawson said he has discussed patching with hyperscalers, banks, retailers, and government agencies. None told him they were able to stay on top of patching.
The analyst thinks most organizations therefore can't understand their level of "threat debt" – a measure of technical debt focused on known but unfixed security exposures – but wrongly think accelerating patching efforts is the way to reduce it.
Lawson thinks that's folly, because developers issue more patches than users can implement safely.
[2]
"Patches break things," he said, or are so complex to implement that the work may not be worth it. "You can't patch Java because there might be five other subsystems that need a patch before you patch Java."
[3]
[4]
The effort required to determine if a patch will have unintended consequences may also be ineffectual, because his research suggests criminals exploit just 8-9 percent of vulnerabilities and most of the flaws they target aren't rated critical – cybercrims focus on less serious problems.
"We are not in the age of industrialized vulnerability exploitation," he said, and attackers sometimes ignore even nasty zero-days.
[5]
"State actors are reluctant to use them because it is a boomerang – use it and it will come back and hit me in the face," the analyst added.
Futile flurry
Lawson thinks organizations try to implement all patches anyway, sometimes to meet internal metrics for speedy patching, or to ensure they meet regulatory compliance requirements.
But such practices haven't led to a decrease in successful attacks.
"Imagine if this was a serious discipline like building bridges and someone said, 'Hey, we have to stop bridges falling down.' Then you spend all this extra money to make sure that doesn't happen, and then more bridges fell down," he said.
"You think someone would come along and say, 'Do you even know why bridges fall down in the first place?'"
[6]Apple patched one first, but Microsoft’s blasted five exploited flaws this Pa-Tu
[7]Microsoft pitches pay-to-patch reboot reduction subscription for Windows Server 2025
[8]Oh, cool. Microsoft melts bug that froze Server 2025 Remote Desktop sessions
[9]Microsoft rated this bug as low exploitability. Miscreants weaponized it in just 8 days
Lawson says company directors are now asking that sort of question in boardrooms, and one answer which often emerges is patches aren't necessary because organizations have controls in place to compensate for unpatched systems.
He suggests orgs develop a "cohabitation metric" that explains how to live with unpatched systems by considering compensating controls that can ameliorate a flaw, and how patching is an extra control that organizations can apply at the appropriate time.
[10]
Lawson wants IT operations and security people to share that metric with applications teams, and anyone else with a stake in an org's security posture, so they can jointly develop a plan on what to patch and when.
"You don't make a population healthy by giving everyone an aspirin," he said. "You give them individual treatment."
Creating that tailored plan requires collaboration across an organization to identify security needs and the patches that IT pros can most easily implement and therefore put high on a to-do list, Lawson says.
And while creating that plan, don't feel that going slow on patching is a sign of failure. "People are made to feel bad, while everyone else is killing it," he said. "The reality is patching sucks for everyone." ®
Get our [11]Tech Resources
[1] https://www.theregister.com/2025/05/14/patch_tuesday_may/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2aCS-CQBpX0ATvI-CtBnYUAAAANc&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aCS-CQBpX0ATvI-CtBnYUAAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aCS-CQBpX0ATvI-CtBnYUAAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44aCS-CQBpX0ATvI-CtBnYUAAAANc&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://www.theregister.com/2025/05/14/patch_tuesday_may/
[7] https://www.theregister.com/2025/04/28/windows_server_2025_hotpatching_subscription/
[8] https://www.theregister.com/2025/04/25/microsoft_fixes_windows_flaw/
[9] https://www.theregister.com/2025/04/21/microsoft_apple_patch/
[10] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/patches&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33aCS-CQBpX0ATvI-CtBnYUAAAANc&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[11] https://whitepapers.theregister.com/
By patching sooner and more often, you are also making yourself MORE vulnerable, to supply-chain attacks..
You won't necessarily spot those in your test environment either.
Patch only for vulnerabilities that affect you - don't just patch for patching's sake as soon as a newer version of any software package you use becomes available
Tell that to compliance (and ultimately the law)
Generally, I'd happily say that rushing to patch is a waste of time. Every time you are risking system stability (a known known) for some variant of improved security (an known unknown). Not a great trade.
However, we all know that if you were to be breached. and it turned out that you had not been applying patches (even if that would not have prevented the breach) then it's sueballs at dawn.
If the UK government were serious about growth and attracting investment (spoiler alert: they aren't) then they could do a lot worse than develop an official framework that ignored vendor recommendations (which mysteriously always suggest increasing your spending) and provided a playbook for companies that would be backed in civil disputes.
Re: Tell that to compliance (and ultimately the law)
If the government (either side of the pond) were serious they wouldn't be using MS products anyway.
Re: Tell that to compliance (and ultimately the law)
"system stability (a known known)"
For some value of stability.
Patch? Yes - but maybe the greatest threat lies elsewhere
I'd suggest patching - for all the rather good reason JimmyPage offers: if you don't patch and you get compromised, your underwriters will almost certainly walk away from any claim. However, as Redmond prove pretty much every time, being an early adopter of patches might put you at significant risk of falling over.
Despite this the greatest threat of compromise appears to come from social engineered attacks so, while patches are required and should be applied in good time (testing on non-live, etc notwithstanding), most companies would see a greater increase in security by better educating their user base.
Re: Patch? Yes - but maybe the greatest threat lies elsewhere
"most companies would see a greater increase in security by better educating their user base"
And strictly limiting the possible blast radius of any given user.
Broke my PC again -thats 5 times in the row since I installed 24H2 update. Spent several hours yet again this morning fixing it. Windows 11 repair option actually worked this time, after the latest update broke the component store, which DISM and SFC couldn't fix. Sick of 24H2. Just cannot trust MS patch Tuesday's. Pathetic state of affairs MS.
24H2
that is your problem right there
Broke my PC again
Well, if it's broken then nobody's going to be able to compromise it.
Sounds like it's secure to me.
Too much other junk lobbed in under the guise of "updates".
You should be able to select "only security updates" and then all you get is a very minimal set of very small patches that don't add features, remove them, break functions, bundle in Copilot, etc.
But Microsoft are too dumb to do that. That's not what happens at all. What happens is your cluster falls over because it hasn't been tested on a cluster, your DCs collapse because of a known bug in that update that makes DCs fall over, you end up with Edge / Copilot forcibly reinstalled, the downtime is on the order of an hour because there's a .NET Framework update in there too, and before you know it you're trying to back those out which now takes even longer.
And that's JUST me talking from my experience over the last year alone with 3 servers.
"Imagine if this was a serious discipline"
Yes, just imagine if IT systems were pervasive throughout the entire planet and critical infrastructure relied on them, often for life and death. Then, just then, we might consider it "serious"!!
It's all very well saying don't patch, or at least don't patch straight away, IF your systems are well controlled and documented with minimal attack surface, and/or run software that requires specific patch levels. Systems like that should also be inaccessible to users and allowed nowhere near the internet.
However, given that most companies that get compromised do so by stupid users visiting websites that they shouldn't or plugging in USB sticks that they found or any of a dozen other behaviours, client systems are getting patched ASAP.
A company I worked at not that long ago sent out a faux-phishing email as a test of user security, even after some bright spark sent out an all staff email TELLING everyone how clever he was for discovering that it was a test, loads of people still visited the link and got caught out.
Did that years ago, but it had issues
Speed to get critical updates out if you really need to test
trying to get a manager approval for a 0-day bug and pushing that vulnerability fix
Relying on local IT to determine what machines to have in test/pilot before production phases - and then hearing them whinge when a patch has hit prod and causes then issues (they either removed all the devices from those groups or didn't bother in the first place)
relying on teams to test
Making sure all patches are actually deployed and rebooted (forced on users with 3 x delay, but never a server as we had no idea who was using or when - down to local IT to resolve... if they bothered)
Only thing with an audit, if you could show you pestered local IT for devices, lists of machines not connected to patching systems and how to resolve (beyond your own processes or GPO), machines that needed a set of reboots and code to do this quickly, they were OK
I would not want to be doing that all these days
While we're on it
And don't change the oil in your car.
You don't see hulks along the side of the road that died from old oil.
More bollocks from Gartner. It must be a day of the week ending in "y".
Don't talk about patching, prioritisation or "vulnerability management", get your processes in place to patch test environments, test the app and then roll out to production (with tested backout processes).
Then you can talk about exceptions