Updates and security

Protection

What happens between a patch being published and installed, why automatic updates are worth it and when to wait.

Update notifications get postponed for months: inconvenient, time-consuming, “it works as it is”. Meanwhile most successful attacks on ordinary people come not through clever schemes but through vulnerabilities patched six months ago.

What happens after a patch ships

  • Day one

    The update ships. Along with it, a description of the vulnerability. Until then a narrow circle knew; now anyone interested does.

  • First week

    A ready-made tool appears. From the description, the attack is reproduced and published openly. The skill required drops to zero.

  • After that

    Mass scanning. The vulnerability is not sought at you personally but by sweeping the whole internet. Whoever has not updated is caught, indiscriminately.

So the gap between a patch shipping and being installed is the most dangerous time, not the calmest.

What must be updated

WhatWhy it mattersHow
The browserThe main door to the internet; its flaws are exploited firstAuto-update, restart every couple of days
The operating systemPatches close flaws exploitable without your involvementAuto-update
The banking appIt handles money and confirmationsAuto-update
The routerAll home traffic passes through it and it is rarely updatedManually, twice a year
Smart devicesFew updates, and they live for yearsCheck at setup and twice a year
Browser extensionsThey have access to page contentsDelete the unused ones, update the rest
Menu names differ between systems and versions — look for “Update”, “Software update” or “About”.

When waiting makes sense

Caution is justified in two cases, and both are rare.

  • A major system upgrade in its first days. Not a security patch but a whole version change: those do break things. A week of waiting is reasonable.
  • A work computer with critical software. If your work depends on it, check compatibility first.

Ordinary security updates should not be postponed: they are small, install in a minute and fix exactly what is already being exploited.

Putting it off
  • The notification sits there for months
  • Updates installed “when there is time”
  • The router still runs its factory firmware
  • Nobody has reviewed the old browser extensions
Sensible
  • Auto-update on wherever it exists
  • The browser is restarted regularly
  • Router firmware checked twice a year
  • Unnecessary extensions removed

Router settings in detail are in home network security, and smart devices in the smart home.

Copied