Here’s How to Make Patching Security Holes Easier For Everyone

The #CyberAvengers are a group of salty and experienced professionals who have decided to work together to help keep this nation and its data safe and secure. They are Paul Ferrillo, Chuck Brooks, Kenneth Holley, George Platsis, George Thomas, Shawn Tuma and Christophe Veltsos.

A lot has been said recently about patching and what role it plays in cybersecurity. A patch is just a small piece of software, made available to the consumer from the software company that “patches” a security flaw in the software. That’s all. But these patches, when installed, can save you a world of hurt.

Many of the worst breaches we have seen could have been avoided if patches were installed in a timely manner. Before we start getting flak that patching for an entire enterprise is not some “flick of the switch” easy procedure, we’re on your side. We agree with you. You need a system in place so you can roll out these patches on all devices within your enterprise. The biggest problem for enterprise-sized organizations is not so much installing the patches but managing the logistics behind patching an entire system. It’s more project management than anything, so you need to find what is right for you and your organization.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

What we are looking at in this piece is something much more micro in nature: your personal devices. Bring-your-own-device adoption is strong. Your employees like it. You may even like it. Not having to carry around duplicate devices is obviously convenient, but from a security perspective, it’s pretty silly. Very few people have matching security protocols (both technical and behavioral) between their professional and personal devices.

We also understand that patching for the everyday user is tedious. Name your reason: don’t know how to do it, eats up my bandwidth, too lazy. So we want to make it easy for everyday users to patch their personal devices.

One of the biggest hurdles we see is bandwidth considerations. Many younger people are big BYOD users, but they can also be guilty of poor security behavior (can anybody say Wi-Fi in a coffee shop or airport?). Older generations are just as guilty here, but give us a moment. Younger people have made a larger shift to mobile communications being their primary form of data consumption. But this comes at a cost and people are on budgets. Therefore, if your data plan restricts you to a couple of GB per month, you may have automatic updates on your devices turned off because you can’t afford a 400 MB update.

So here is our solution: Make bandwidth consumption for patches free. This would require some teamwork between the big tech companies and the internet providers (hardline and mobile), but it can be done. Service providers do have the technology do to do this. For example, if you have certain video or audio streaming services, that data will not be charged against your monthly plan. Do the same for security patches coming from Microsoft, Apple and Google. No charge. Let them do it over-the-air instead of needing to plug into a Wi-Fi network. And don’t pass on the fee to the consumer.

Just do this for the good of the nation and let’s be honest, it’s less of a problem for the service providers and big tech companies when devices are patched because patched devices are a big step in preventing widespread infection.

That’s all. It’s simple. And it encourages individual users to get into the habit of patching their personal devices and turning automatic updates on, whether it is on their desktop, laptop, or mobile device.

One final note if we could make: mandatory support from software developers for 20 years. We saw in recent breaches that systems were still using Windows XP (we even think some were using Service Pack 1). Some software developers may not like this because they’ll say it’s too expensive to keep support for that long. Perhaps that is true. But it also puts pressure on software developers to make sure strong and secure code is released in the first place. We would never accept a car that would require continual servicing for major components, like the engine or brakes. Therefore, we should get out of the habit of continually servicing our software and focus on developing stronger and more secure code out of the gate.

But we’re realists. That’s why we propose this interim solution: making patching and protecting all American devices easy, especially for the individual. If nothing else, it hopefully can stimulate a culture change in our cybersecurity behavior.