UK's NCSC warns of ‘wave of patches’

Prioritise external surfaces

The first of these pillars is the prioritisation of external attack surfaces. Security teams should work to identify any attack surfaces that are exposed to the public internet as soon as possible. Teams should start with technology on the perimeter of the network, and then work their way inwards, via cloud instances, to on-prem environments.

When vulnerabilities come to light, in instances where updates cannot be applied across the entire environment, security teams should prioritise external attack surfaces, and where capacity extends beyond external surfaces, they should lead with critical security systems.

This said it is important to remember that patching by itself will not always be enough. There may – indeed there very probably is – still technical debt in end-of-life or legacy systems that can’t be patched. If these cannot be brought back within support then they need to be replaced.

Prepare to patch faster and more regularly 

The second pillar concerns patch management. Here, organisations should plan to deploy vital software updates quicker, more often, and at scale, including within their supply chains. The NCSC said it is expecting an influx of updates to address flaws at varying levels of severity – many of them are likely to be critical.

The agency recommends organisations priorities activating supplier-provided automatic, secure hot-patching features that don’t involve service disruption – this will have the pleasant side-effect of reducing the security team’s workload.

But if automated patching is not available, security leaders will need to plan to ensure processes and risk appetites support frequent, scaled updates, accounting for the inevitable trade-offs around disruption. Risk-based approaches, such as the Stakeholder Specific Vulnerability Categorisation (SSVC) system can be used to prioritise installing the updates.

Of course, this assumes that critical flaws aren’t under active exploitation – those that do present as zero-days, especially those affecting external-facing systems, will need to have their update schedules brought forward.

Prioritise the basics

The third and final pillar is to look beyond simply updating vulnerable software. Patching alone won’t address the systemic cyber security problems faced by the overwhelming majority of organisations.

The NCSC renewed its appeal to technology firms to ensure systemic technical debt is minimised through memory safety and containment technologies where appropriate.

At end-user organisations, CISOs should keep focus on the fundamentals of cyber security to improve their overall resilience and reduce the impact of breaches through whatever means they originate – whether that be through a vulnerable product or something else. Such an approach should include seeking Cyber Essentials certification, or running  the Cyber Assessment Framework for essential services operators.

“[The] NCSC advise[s] all organisations, irrespective of size, to plan and prepare for the vulnerability patch wave. A good place to start is by reading the NCSC’s updated Vulnerability Management guidance,” said Whitehouse.

“For larger organisations, we also recommend working to gain assurance from your supply chains both commercial and open source, so that they are prepared to navigate any required response.”

Lionel Litty, CISO at Menlo Security, said: “This is a timely update from the NCSC. It makes two important points: the external attack surface needs to be prioritised and we need to go beyond software updates and look at containment technologies to reduce the impact of breaches.

“For the majority of users, the web browser is where most of the external attack surface exists. To make this more concrete: just last week, Mozilla announced that it fixed 271 vulnerabilities in the Firefox browser. These vulnerabilities were found using Claude Mythos, Anthropic's latest AI model. This is up from 22 vulnerabilities found by the previous iteration of Claude.

“This highlights the need not only to ensure that your organisation can rapidly and comprehensively deploy browser updates, but also to fundamentally reduce the risk,” said Litty. “Technology such as remote browser isolation can move the attack surface off the user's endpoint, minimising the damage if a user is exposed before their browser is patched.”