2 cissp ® Official Study Guide Eighth Edition

725
Approve the patches.
After administrators test the patches and determine them to be safe, 
they approve the patches for deployment. It’s common to use a change management process 
(described earlier in this chapter) as part of the approval process.
Deploy the patches.
After testing and approval, administrators deploy the patches. Many 
organizations use automated methods to deploy the patches. These can be third-party prod-
ucts or products provided by the software vendor.
Verify that patches are deployed.
After deploying patches, administrators regularly test 
and audit systems to ensure that they remain patched. Many deployment tools include the 
ability to audit systems. Additionally, many vulnerability assessment tools include the abil-
ity to check systems to ensure that they have appropriate patches.
Patch Tuesday and exploit Wednesday
Microsoft regularly releases patches on the second Tuesday of every month, commonly 
called Patch Tuesday or Update Tuesday. The regular schedule allows administrators to 
plan for the release of patches so that they have adequate time to test and deploy them. 
Many organizations that have support contracts with Microsoft have advance notification 
of the patches prior to Patch Tuesday. Some vulnerabilities are significant enough that 
Microsoft releases them “out-of-band.” In other words, instead of waiting for the next 
Patch Tuesday to release a patch, Microsoft releases some patches earlier.
Attackers realize that many organizations do not patch their systems right away. Some 
attackers have reverse-engineered patches to identify the underlying vulnerability and 
then created methods to exploit the vulnerability. These attacks often start within a day 
after Patch Tuesday, giving rise to the term 
exploit Wednesday
.
However, many attacks occur on unpatched systems weeks, months, and even years after 
vendors release the patches. In other words, many systems remain unpatched and attack-
ers exploit them much later than a day after the vendor released the patch. As an exam-
ple, the WannaCry ransomware attack in May 2017 infected more than 230,000 systems 
within a day. The attack exploited systems that didn’t have a Microsoft security update 
that was released in March 2017, about two months earlier.