Microsoft and NIST partner on best patch management practices

After the NotPetya ransomware attack of 2017, Microsoft conducted research into why large companies were being affected even though patches were already available.  Microsoft visited a significant number of customers and was surprised by how many challenges organizations faced with processes and standards.  They discovered many companies failed to install patches because they simply didn’t have a patch testing procedure in place.  Instead, they would wait a while and then ask an online forum if anyone has experienced any problems with the patches before applying them.  In addition, Microsoft has spoken with partners like the Center for Internet Security (CIS), U.S. Department of Homeland Security (DHS) Cybersecurity, and Cybersecurity and Infrastructure Security Agency (CISA).  This led Microsoft to team up with NIST and “build common enterprise patch management reference architectures and processes, have relevant vendors build and validate implementation instructions in the NCCoE lab, and share the results in the NIST Special Publication 1800 practice guide for all to benefit”.  They are also extending an invitation to other vendors so they can collaboratively work on addressing this problem.

Source: https://sdtimes.com/msft/microsoft-and-nist-partner-on-best-patch-management-practices/