TechKnowSurge
CompTIA Tech+ 6.1 CompTIA A+ Core 2 2.4 CompTIA Server+ 3.1 CompTIA Tech+ 6.2 CompTIA A+ Core 2 2.6 CompTIA Server+ 3.2
TechKnowSurge Catalog Videos DEMO: Patching Software
VideoComputeFree

DEMO: Patching Software

Software vulnerabilities follow a lifecycle from discovery to public exposure to patching, and keeping all applications updated is one of the most effective ways to reduce security risk. Understanding how that lifecycle works helps organizations minimize the window of exposure before a fix is available.

⚑ Complete this video to capture a CTF flag worth 1 point.

About this video

Software vulnerabilities are unintentional flaws in code that create unauthorized pathways for attackers to exploit a system. Every vulnerability follows a defined lifecycle with three broad phases: initial existence as a zero-day, active discovery and exploitation by threat actors, and eventual remediation through a security patch. During the zero-day phase, the flaw is present but largely unknown, which limits immediate risk. The danger increases significantly once the vulnerability is discovered and shared among attackers, and reaches a critical level when it is published to the Common Vulnerabilities and Exposures list, making it accessible to a wide range of bad actors. The primary security objective around patch management is to minimize the time between a vulnerability becoming known and a patch being applied across all affected systems. Every day that passes in that window represents ongoing exposure for the data and systems the vulnerability affects. Operating systems have become increasingly reliable at applying updates automatically, but third-party applications installed on the same machines are frequently overlooked. Web browsers, productivity tools, and other software require regular manual checks or dedicated patch management processes to ensure they remain current and protected against known threats.

What you'll learn

What's covered

Maintaining Software Updates

Aligned to

CompTIA Tech+
6.1 Summarize confidentiality, integrity, and availability concerns.
6.2 Explain methods to secure devices and best practices.
CompTIA A+ Core 2
2.4 Explain common social-engineering attacks, threats, and vulnerabilities.
2.6 Given a scenario, configure a workstation to meet best practices for security.
CompTIA Server+
3.1 Summarize data security concepts.
3.2 Given a scenario, apply server hardening methods.

Key terms

Vulnerability
A weakness in a system, application, or process that can be exploited by a threat actor.
Zero-Day
A vulnerability that is unknown to the vendor and has no available patch at the time of exploitation.
Exploit
A piece of software or technique that takes advantage of a vulnerability to gain unauthorized access or cause harm.
Patch Management
The process of acquiring, testing, and installing software updates to fix vulnerabilities and improve functionality.
Common Vulnerabilities and Exposures
CVE
Common Vulnerabilities and Exposures is a publicly maintained dictionary that assigns unique identifiers to known software and hardware vulnerabilities, providing a common reference point for vulnerability tracking, disclosure, and remediation.
Window of Vulnerability
The period of time between the discovery or disclosure of a vulnerability and the application of a patch, during which a system remains exposed to exploitation.

Topics

Vulnerability Management Patch Management Cve Zero Day Vulnerabilities Software Security Operating Systems

Transcript

One thing that we need to make sure we do on all of our software is maintain updates to make sure that it's up to date.

Vulnerabilities

One of the main reasons why we want to make sure our systems are patched is because of vulnerabilities. Let's imagine a gate. If we have a gate that has a key to the gate, but suddenly we have a vulnerability, a break in the gate — now we have another way that somebody can get behind the gate, or get through the gate, or get to the other side of the gate. And that's going to be a problem.

Same thing with your software. There are times when people are writing code and they don't realize that they've introduced this flaw, this vulnerability, this way for people to exploit that program and cause problems on your system. That's what a vulnerability is.

The Vulnerability Life Cycle

Vulnerabilities have a life cycle. That is, a beginning, middle, and end. So when it begins, it's what we call a zero day, a zero day vulnerability. What happens is that code gets put out into the public. Like let's say I'm a programmer. I've got this code, I've got this program. I create this program and then I put it out there. And now I put it out there with a flaw. But obviously I didn't realize that there was a flaw in it. I put it out there thinking that it was good, but there is a flaw. So at that point in time I have zero days to really act on it. It's out there in the wild now. So that's what's known as a zero day.

And when it is in this zero day state, it's not that big of a deal, because no one necessarily knows that it exists. But you're going to have people that are going to start testing the software and see if they can exploit the software, and that's when it becomes a risk, that's when it becomes a problem.

So then it becomes known. So it's known to a hacker, which obviously is going to be a problem. And then at some point in time probably other people are going to be aware of it, and then it goes on what's called a CVE, or common vulnerabilities and exposure list. At that point in time it's public knowledge, and everybody who knows a little bit about hacking might try to take this vulnerability and exploit that vulnerability, take advantage of that vulnerability. And so now we have a serious problem, that a lot of people are aware of the problem, and at the same time the hackers can go in and try to exploit that problem.

So then we're going to release a patch. So we're going to say, okay, what we need to do is do a security patch to fix this issue. So we're going to send that out to fix the issue and repair, in my prior example, the gate.

So now our goal of this is really to minimize the time between a zero day and when things get patched, because this is the problem area right here: when it's been known out there, or somebody's trying to discover it, yet there is not a patch for it yet. And then the longer you go before you patch your systems, the longer this window is causing exposure to you and your program and whatever data is on the program, or whatever this vulnerability exploits.

Checking for Updates

I'm on one of my demo machines right here, and what we're going to do is we're just going to take a look at a couple updates. One of them is the Windows update. And what I'm going to do is click the start and just type in Windows update, and it will check for Windows update. So I can do check for update. Now, it's already said that it's checked today, so that's great that it keeps it up to date. My settings are all set up so that way this is up to date. But if I wanted to, I could click on check for updates and go through the process of checking to see if there's any new updates for this. So that's one way that I can do this. This is for the operating system and the software that runs this machine. And in fact, it actually did find some updates, so it's going through the process of downloading those.

So the other thing I wanted to show you is Chrome. So let's get into Chrome. And what we're going to do here is just go to settings here, and we're going to take a look at the About Chrome page. And you can see here that it found an update to Chrome and it's doing the update to Chrome.

And so one of the points that I'm trying to make here is, a lot of times I think most of us know that we're supposed to update our operating systems, and our operating systems have got really good about updating. But as you can see here, not all the software gets updated on a regular basis. So there are times when we need to go and check. So this is what really gets overlooked: a lot of times our other software that's installed on the machine will get overlooked. So it's asking me to relaunch, so then I can relaunch this and then this new update will be done.

About TechKnowSurge

TechKnowSurge builds IT and cybersecurity professionals through hands-on, concept-first training built around real understanding — not memorization. Free interactive tools, structured programs, and 25+ years of real-world experience, all in one place.

Explore free tools and programs →