Perform Automated Operating System Patch Management
Description
Perform operating system updates on enterprise assets through automated patch management on a monthly, or more frequent, basis.
Implementation Checklist
Tool Recommendations
Continuous vulnerability assessment and exposure management across IT assets, cloud, containers, and OT
Tenable · Per-asset subscription
Cloud-based vulnerability management, detection, and response with integrated patch management and asset inventory
Qualys · Per-asset subscription
Vulnerability management platform with live dashboards, risk prioritization, and remediation workflows
Rapid7 · Per-asset subscription
Threats & Vulnerabilities (CIS RAM)
Threat Scenarios
Mass Exploitation of Unpatched Operating Systems
AvailabilityThreat actors leverage automated scanning tools to identify enterprise systems running unpatched operating systems and deploy ransomware or cryptominers through known OS-level vulnerabilities like EternalBlue or PrintNightmare.
Wormable OS Vulnerability Propagation
AvailabilityA wormable vulnerability in an unpatched operating system allows malware to propagate laterally across the network without user interaction, as seen with WannaCry and NotPetya, because automated OS patching is not in place.
Kernel-Level Privilege Escalation on Unpatched Hosts
ConfidentialityAttackers exploit unpatched kernel vulnerabilities to escalate from standard user to SYSTEM/root privileges, bypassing all application-level security controls and gaining full control of the compromised host.
Vulnerabilities (When Safeguard Absent)
Manual or Ad-Hoc OS Patching Process
Operating system patches are applied manually or on an irregular schedule, resulting in significant patch lag where critical OS updates may not be deployed for weeks or months after release.
No Centralized Patch Management Platform for OS Updates
The organization lacks a centralized tool (such as WSUS, SCCM, or Jamf) to automate OS patch distribution and verification, making it impossible to ensure consistent patch levels across all enterprise assets.
Inconsistent Patch Coverage Across OS Platforms
Automated patching may cover Windows endpoints but miss Linux servers, macOS devices, or specialized operating systems, leaving significant portions of the fleet running vulnerable OS versions.
Evidence Requirements
| Type | Evidence Item | Collection Frequency |
|---|---|---|
| Technical | Configuration screenshots or exports showing protection controls enabled | Captured quarterly |
| Document | Procedure documentation for protection measures | Reviewed annually |
| Document | Governing policy document (current, approved, communicated) | Reviewed annually |