Practical Security

If Patching Hurts, Do It More Often

Martin Fowler has written about the saying, “If it hurts, do it more often” as it pertains to activities like deployments and integration.^[27] This idea fits wonderfully into a discussion on patching. Fowler gives three main reasons why doing painful things more often makes them less painful over time:

1. It breaks work into small, manageable pieces.
2. It adds opportunities for feedback.
3. It provides practice and the potential for automation.

Let’s see how breaking the patching process up into smaller pieces can help us. There’s generally a long period of time between patches that fix truly critical vulnerabilities. If we wait and only apply these critical patches, the upgrade will be a bigger job and there will be ...