Interview Question: How often do you update/patch your system?

[u/CurrentFig3376]

I was asked this question during an interview and I said "it depends on what exactly you're updating, but I update as often as it's needed."

I don't think this was the answer they were looking for, but how would you answer this question?

[u/bemenaker]

On A monthly schedule. Normally delayed a week after patch Tuesday. Let other people find the broken patches to maintain our reliability. Unless it's a critical active exploit patch, and then as soon as possible in a sane and safe way.

[u/mesaoptimizer → u/bemenaker]

I feel like this is old advice. There are too many 0 days and attackers have gotten too fast at exploiting stuff to wait a week before you start patching. My current org starts patching Development on Wednesday (this avoids the emergency pulls from completely broken patches) and we complete production patching on Friday the week of patch Tuesday, sometimes expediting internet facing systems as early as Wednesday if we've got known exploitation. I imagine that we're not too far away from occasionally needing to expedite to same day patching if agentic exploitation continues on the path it seems like it is going.

[u/bemenaker → u/mesaoptimizer]

Microsoft just recommended patching every 3 days because of the speed of AI threats. Yes it is old advice, but not necessarily bad advice. Not like MS is dropping patches every 3 days. But you should watch for critical patches being released and apply as necessary as I said. MS still releases their standard patch Tuesday once a month unless warranted.

The risk of how long after Tuesday to update is a risk tolerance vs MS crashing your shit tolerance.

If you're tracking the threat announcements, you will know if you need to deviate and patch immediately.

[u/Ssakaa → u/bemenaker]

Is that "every 3 days" or "within 72 hours"? Because one of those is reactive, somewhat high paced, but sane, the other is just... odd.

[u/bemenaker → u/Ssakaa]

I'm assuming 72 hours. It's their verbage not mine

[u/Cubewood → u/mesaoptimizer]

Same here, manage patching for a very large org (400k+ endpoints), and we used to patch just once a month, but thanks to the AI enabled vulnerability research, you just cannot do this anymore. Something like Google Chrome releases multiple patches every week, which remediate hundreds of vulnerabilities, many of them exploitable, so since the start of this year I've setup automatic deployment rules for everything to run three times per week. Patches go out to Ring-0 for three days, if nobody complains it goes to production after that.

[u/Steve_at_Werk → u/bemenaker]

We do QA the weekend after patch Tuesday, DR the next weekend, and the following.  It allows us to catch and address any issues the updates may cause. 

[u/mvbighead → u/bemenaker]

This x100. Allow the masses to find any issues with the patch, and if possible, you can delay your upcoming patch cycle if there is word that a patch interacts poorly with a product you use. Can't remember specifically what some of the last ones were, but I feel like a fairly prominent security tool played poorly with a patch one cycle and caused some havoc.