Two of the eight controls in the Essential Eight matrix focus entirely on updates: Patch Applications and Patch Operating Systems. Why? Because exploiting known vulnerabilities in unpatched software is arguably the most common way ransomware spreads.
The "48-Hour" Rule
For organizations aiming for Maturity Level 2 or 3, the ACSC poses a stringent requirement: Critical vulnerabilities or vulnerabilities where an exploit currently exists in the wild must be patched within 48 hours.
For a small business without a dedicated full-time IT team, this timeline sounds impossible. Manual patching across 50 employee laptops and 5 servers is a recipe for missed deadlines.
Best Practices for Automated Patch Management
- Endpoint Management Systems: Deploy an RMM (Remote Monitoring and Management) or MDM (Mobile Device Management) tool such as Microsoft Intune to force silent updates to operating systems.
- Third-Party Application Patching: Do not just patch Windows. Ensure your patching system also updates PDF readers, web browsers (Chrome/Edge), and communication tools (Zoom/Teams), as these are highly targeted.
- Vulnerability Scanners: Utilize lightweight vulnerability scanners to identify devices that have missed patch cycles due to them being offline or off-network.
If you're unsure if your business meets the rigorous timeline constraints set out by the ACSC for patch management, our Essential Eight Reporting Tool will highlight the gaps in your patching vulnerability strategy.