Why doesn't everyone just install the patch the day it comes out?
Equifax's breach began in May 2017, two months after the fix for the hole was published. Patching sounds easy and almost never is.
Guess first
?
Which one is it?
Because installing a patch is easy on one laptop and hard on thousands of machines that people depend on. A patch is data for modifying existing software, often to fix bugs and security . When a serious hole is found, the maker releases one and urges everyone to update immediately. Yet the gap between the release and the moment that everyone has installed it is exactly the window that attackers use.
The pattern is painfully consistent. A key security patch for the Apache Struts web framework was released on 7 March 2017, and by 10 March security experts had seen a hacking group scanning for sites that had not updated. On 12 May 2017 the breach of the credit bureau Equifax began, when it had not yet updated its credit dispute website. Records of 147.9 million Americans, 15.2 million British citizens and about 19,000 Canadians were compromised.
7 March 2017
Key Apache Struts patch released
10 March 2017
Scanning for sites that had not updated is detected
12 May 2017
The Equifax breach begins
Why do organisations fall behind? A patch can introduce new problems, a scenario called , so careful teams test before they install. Patch management is a whole job: deciding which patches to apply to which systems, and when. And a big organisation has to know what it owns first. Equifax's 2015 internal audit found it was not adhering to its own patching schedules, that IT staff lacked a comprehensive inventory of their assets, and that it did not prioritise patches by how critical each system was.
The same story ran in 2003, when a patch for the hole used by the SQL Slammer worm had been available for six months, but many installations, including many at Microsoft, had not been patched. Patching is less a technical puzzle than a logistics puzzle: finding every machine, testing, scheduling downtime, and doing it before someone else does it first.
Try it
A simple model of a fleet getting patched
y = 1 / (1 + e^(−0.2(x − 11)))
Challenge · At the starting settings the curve passes 45% at day 10, like the Log4Shell research. When does it reach 90%? Then try to get 90% patched within two weeks.
Quiz me
0/3
Recap
A published fix protects nobody until it is installed on every machine, and finding every machine is the hard part.
💡 A trick to remember it · A vaccine in the fridge protects no one: a patch only counts once it has reached every arm.
Surprising fact · The Equifax breach began about two months after the key Apache Struts patch was released.
Connects to
- 🪱 How did a 376-byte worm infect the internet in ten minutes?
- 💔 How did one bug put much of the internet at risk, from Heartbleed to Log4Shell?
- 🔒 How did ransomware take hospitals and a fuel pipeline hostage?
- 🕳️ What is a zero-day, and why do companies pay hackers to find bugs?
- 🦋 Was the first computer bug really a moth?
Sources (5)
No source, no claim. Every fact in this lesson (13 claims) cites at least one of these.