"If it is not broken, do not touch it" is good advice for a lot of life. It is terrible advice for software updates.
Most break-ins use old tricks
People expect attacks to use some brand-new, never-seen technique. Most do not. They use flaws that were fixed months ago, in an update somebody's system never got around to installing. The attacker is not smarter. They are betting on procrastination, and winning a lot.
Government security agencies publish lists of flaws that attackers are known to be using right now, and for nearly all of them a fix already exists. The U.S. Cybersecurity and Infrastructure Security Agency keeps one called the Known Exploited Vulnerabilities catalog.
So the notification is not nagging
That update prompt is closing a door that has a well-documented way to open. A prompt sitting there for weeks means the door is open for weeks.
What to update, beyond the operating system
- Windows and Mac operating system updates
- The software people use every day: browsers, PDF readers, office applications, remote-access tools
- Network equipment like firewalls, routers and wireless access points, which are easy to forget because nobody sees them
- Phones and tablets used for work
You do not have to chase every headline
You do not need to read security news. You just need updates not to pile up for months. Turn on automatic updates where it is safe, pick a regular day for the rest, and make sure someone is responsible for confirming it happened. Restarting matters, because many updates only finish after a restart.
The hard part is knowing, across every computer, which ones are actually up to date. That is why we run patching and device security as an ongoing service. It is included in our company packages, and a managed IT partner should be able to show you the proof, not just say it is handled.
If you would like a second set of eyes on this, call or text (316) 347-7630, or send us a note.