{"id":89986,"date":"2019-10-09T09:00:59","date_gmt":"2019-10-09T16:00:59","guid":{"rendered":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/\/?p=89986"},"modified":"2023-05-15T23:07:47","modified_gmt":"2023-05-16T06:07:47","slug":"patching-social-responsibility","status":"publish","type":"post","link":"https:\/\/www.microsoft.com\/en-us\/security\/blog\/2019\/10\/09\/patching-social-responsibility\/","title":{"rendered":"Patching as a social responsibility"},"content":{"rendered":"
In the wake of the devastating (Not)Petya attack, Microsoft set out to understand why some customers weren\u2019t applying cybersecurity hygiene, such as security patches, which would have helped mitigate this threat. We were particularly concerned with why patches hadn\u2019t been applied, as they had been available for months and had already been used in the WannaCrypt worm\u2014which clearly established a \u201dreal and present danger.”<\/p>\n
We learned a lot from this journey, including how important it is to build clearer industry guidance and standards on enterprise patch management. To help make it easier for organizations to plan, implement, and improve an enterprise patch management strategy, Microsoft is partnering with the U.S. National Institute of Standards and Technology (NIST) National Cybersecurity Center of Excellence (NCCoE).<\/p>\n
NIST and Microsoft are extending an invitation for you to join this effort if you\u2019re a:<\/p>\n
If you have pertinent learnings that you can share, please reach out to cyberhygiene@nist.gov<\/strong>.<\/p>\n During this journey, we also worked closely with additional partners and learned from their experience in this space, including the:<\/p>\n A key part of this learning journey was to sit down and listen directly to our customer\u2019s challenges. Microsoft visited a significant number of customers in person (several of which I personally joined) to share what we learned\u2014which became part of the jointly endorsed mitigation roadmap<\/a>\u2014and to have some really frank and open discussions to learn why organizations really<\/em> aren\u2019t applying security patches.<\/p>\n While the discussions mostly went in expected directions, we were surprised at how many challenges organizations had on processes and standards, including:<\/p>\n This articulated need for good reference processes was further validated by observing that a common practice for \u201ctesting\u201d a patch before a deployment often consisted solely of asking whether anyone else had any issues with the patch in an online forum.<\/p>\n\n
\n