High-impact

Patching

Install software and firmware updates, starting with anything reachable from the internet. Turn on automatic updates where you can, and check monthly for the systems that cannot update themselves.

Back to the Toolkit →

Why this matters

Most software flaws are public knowledge before they are exploited. The vendor publishes a fix, the flaw is described alongside it, and attackers work through the internet looking for machines that have not applied it yet. The window between the update being available and being installed is the window you are exposed in.

This is routine maintenance rather than a project, and it is usually free — you have already paid for the updates. What it costs is attention: knowing what you run, deciding when it gets updated, and making sure the things that cannot update themselves are not quietly forgotten.

Patching — checklist

  • Write down what you run: workstations, servers, storage, the firewall and router, VPN, network switches, and any transfer or review platform you host yourself.
  • Prioritize critical security updates and internet-facing systems first. That is where to start, because those systems can be found and probed by anyone.
  • Turn on automatic updates for operating systems, browsers and everyday applications, so routine patching happens without anyone deciding to do it.
  • Handle firmware separately. Firewalls, routers, NAS units and cameras rarely update themselves and are often the oldest software you own.
  • Set a monthly slot to apply anything left over, and treat it as a standing commitment rather than something to fit in.
  • Test updates on one machine before rolling them out where a failure would stop work, particularly on edit and grading systems.
  • Schedule updates that need a restart around the production calendar, so patching is not competing with a delivery.
  • Check equipment still receives updates at all. Anything past end of support will never be patched again and needs replacing or isolating.
  • Subscribe to your vendors' security notices so you hear about urgent fixes rather than finding them next month.
  • Keep a note of what was updated and when. Most clients want to know this routine is real.
Keep going

If this one helped, try another.

Consider these suggestions for what to do next. They either address the same gaps, or are logical next steps.

High-impact Enable MFA Turn on multi-factor authentication for email, file transfer and remote access — one of the most common gaps described in industry security alerts. Fix itThis weekOpen → Start here if you've done nothing else. High-impact Stop account sharing Replace shared and default logins with individual accounts, so activity is traceable to a person and access ends when they do. Fix itThis weekOpen → The other half of the MFA job. High-impact Reduce access Give each person access only to the systems and projects their current work requires, review it when their role changes, and remove it the day they leave. Fix itThis weekOpen → Same afternoon, same admin screen. Gap Analysis Find Your Gaps The free TPN Questionnaire measures your current practices against the MPA Content Security Best Practices, giving you a clear picture of your gaps and a route to closing them. Fix itThis quarterOpen → Tells you which fix matters most for you.