Instructions for Windows and Apple home users are listed below the numbers. For organizations, here are 10 Steps To Avoid Incidents Including the Massive Ransomware Attack:

1. The reality is that most organizations are missing critical security patches and there is a very strong likelihood that yours is too.

2. Provide your team with extra time, and perhaps additional personnel, to test and then deploy patches ASAP. Some organizations are adding a new IT professional to their team whose sole responsibility is to manage patches. If the patch fails testing, then time must be invested to resolve the issue or implement compensating controls.

3. Prioritize critical security patches for the operating system, all the browsers, Flash, Java, your PDF Reader, and Microsoft Office. They are usually the easiest to attack and form your first line of defense.

4. Many IT teams are very reluctant to apply patches for fear of breaking your systems that are already running. Help remove their fears by reassuring them that you take on responsibility if the patch causes a problem. Encourage them to follow a procedure that mitigates risks:

5. Test Patches in a test environment that uses the same applications as the rest of your network. For very small companies, your test environment might be a single computer. For larger organizations, and organizations that stand to lose a great deal in the event of an attack, create a separate testing environment that is isolated from the production environment.

6. Have a pre-tested rollback plan so that, if the patch does cause a problem, your IT team will already know what they need to do right away to roll back a patch that causes an unexpected problem. They will then go back to the testing phase.

7. Deploy the patches in stages rather than patching all machines simultaneously. That way, even if the patch does cause a problem, not all your machines will be affected.

8. You may decide to empower your IT team with a patch management tool such as Ninite, LANGuard, Shavlik, or others. Allow them to test and choose a tool, and provide them with the means and time to do so, ASAP.

9. Ask IT, perhaps weekly and at least monthly, to provide you with a list of missing patches, not a pie chart.

10. You must upgrade from older operating systems, any of the ones that Microsoft no longer supports. If some machines cannot be upgraded, then they must be isolated or some other compensating control put into place. Microsoft clearly states when they stop producing patches for old operating systems.  So, there was no patch available for Windows XP and others.

Call me if they are not able to apply patches. Let’s team up to help prevent this.

At home, or if your organization is so small that you do not have an IT team or have an outsourced IT company that takes care of your patches, be sure that the option that provides automatic updates to Microsoft is enabled. The instructions are easy to find – just google the phrase: configure automatic updates site:Microsoft.com

Apple computer users, google: Automatic security updates os x site:apple.com

iPhone and iPad users, google: Automatic security downloads ios site:apple.com

Additionally, manually check for updates in Microsoft Office to be sure those are applied. Be sure that automatic updates are enabled in your browsers. Regularly download and apply patches to, or new versions of, Flash, Java, and your PDF reader.

Please forward this to everyone you care about and want to help stay secure.

The post Patching – 10 Steps to Seal the Holes in Your Armor appeared first on Foster Institute.

Patching VMware, which is often used as a platform for many of your other servers, can be frustrating. If the patch causes a problem, there is a risk that all your servers hosted on that machine will go down.

This is one of those risk vs. benefit decisions that is so important, business executives must be involved.

On the one hand, the patch could interrupt business, but not applying the patch could be considered reckless.

Test the patch prior to deployment, when possible. Having a pre-planned, if not pre-tested, roll-back plan is crucial in case the patch causes a problem.

Preferably patch one server at a time so that, if the patch does cause a problem, at least the interruption is limited to that server.

Without the patch, someone could run programs on your computer, potentially taking control of the server.

The patch fixes a vulnerability in the VMware Customer Experience Improvement Program, even if a customer is not participating in the program.

Please emphasize the last phrase to your IT pros.

Ask your IT pros to look at VMware’s information by searching for VMSA-2017-0007.

Please forward this to everyone who may be using VMware, so that they can alert their IT pros just in case they don’t know already.

The post Alert Your IT Team – Urgent Patch for Network Servers appeared first on Foster Institute.

A benefit of knowing when to expect patches is that patch time could be planned in advance. Now your IT Pros will have to be vigilant about applying Microsoft patches any time of the month. That’s the way it is with Adobe Flash, Java, PDF Reader, and browser patches.

And, patches do you no good until they are installed on your systems.

Applying patches is one of the best things you can do to protect against hacker attacks.

3 Cardinal rules for patches:

First, test the patches. Patches sometimes cause problems, especially Java patches, so they have to be tested. Test them ASAP so you can deploy them ASAP.

Second, use a staged deployment. Patches need to be deployed first to a few machines, then more, then to the rest of your network. That way, if a patch causes a problem, not everyone is down at the same time.

Third, always have a plan on how to “roll back” the patches if they do cause a problem. That’s just another reason to always have good backups and test your ability to restore.

Microsoft says the new “ASAP” patch release proactive will start when Windows 10 is released. That will probably be in July 2015.

Please post your comments below…

The post Huge Change in Scheduled Patches appeared first on Foster Institute.