Patch management planning - towards one-to-one policy

Software security is a key component in protecting an enterprise’s digital and operational infrastructure. Time from vulnerability disclosure to exploitation is decreasing and a large number of vulnerabilities are being exploited before security teams have implemented patches or other mitigation methods. To achieve a sufficient level of software security, timely patching is critical. However, failure to recognize patching as a necessary business cost is extremely common at many levels of organizations. The lack of proper patch management strategy is apparent. In order to help organizations to improve their patch management planning we surveyed the latest academic publications, vulnerability reports and the latest NIST special publication 800-40 on patch management planning and focused on enriching the provided recommendations for organizations, to improve their management of threats.