Essential Eight PO-ML1.7One-month operating system patching for workstations, non-internet-facing servers and network devices

What this means in practice

Operating system vendors regularly publish fixes for security flaws found in their software. A fix can be a patch, an update that contains the fix, or another mitigation the vendor publishes, such as a configuration change or workaround. This control covers the operating systems of three kinds of asset: workstations (the desktops and laptops people use every day), servers that are not internet-facing (such as internal file, database and directory servers) and network devices that are not internet-facing (such as internal switches and routers). Fixes for vulnerabilities in those operating systems must be applied within one month of the vendor releasing them. It is about the operating system itself, such as Windows, macOS, Linux or a network device's operating system, not the applications installed on it. The month is counted from the vendor's release date, not from when the team first notices the fix, and it applies to every fix for a vulnerability in these operating systems, whatever severity the vendor gives it. It matters because once a fix is published the flaw becomes public knowledge, and attackers can study the fix to work out how to exploit it. Workstations are where many attacks start, through malicious email or websites, and servers and network devices that cannot be reached directly from the internet are still exposed once an attacker has that foothold inside. Unpatched operating systems then make it much easier for the attacker to gain administrator access, spread to other machines and reach sensitive data.