Google Study Finds Most Fail to Prioritize Patching and Updating

“What is possibly more surprising about this research, is that only 35% of security experts consider patching software routinely to be high on their security priority lists. This would explain why so many organizations get hacked on a daily basis,” says Jim Stickley of Stickley on Security. According to Google, this number is true.

Google did some research which focused on the differences in how attitudes about security are different between security experts and non-experts. The bottom line is that non-experts don’t seem to take protecting their data very seriously, on the surface. Only two percent felt that regularly patching software was important.

This does not mean that they don’t care about privacy. What the report found was that they don’t quite understand patching and updating and the benefits and risks to either being diligent about it or not doing it. One of the main concerns is that they are uncertain if applying an update will result in installing malicious software.

In order to avoid this, software should be downloaded from reputable sources, which typically means that it should come through the software developer or its approved channels. If it comes from Microsoft via the automatic updates or directly from Adobe’s website, it’s the right place to retrieve it, for example. If it is an app on a mobile device, it should come from the official app store for the device, rather than sideloaded from another location.

If a popup appears stating you need to update something, second guess it. Instead of clicking “yes” to install or “install,” go directly to the software website to download the update. Don’t click any links in the popups or dialogue boxes, but manually type information into the browser address bar. Popup fatigue is understandable, but resist it and read the dialogue rather than clicking something just to make it go away.

In addition, set your software to automatically update when possible. This will ensure that as soon as critical updates are available, they get applied and you won’t miss them.

If an update for a plugin to a browser is available, remember to apply it separately to each browser you use. One fix does not apply to all of them.

Stickley continued, “Malware designed to exploit a new vulnerability is written within days, if not hours of the moment the issue is first made public. Without applying patches to resolve these new vulnerabilities quickly, many systems are left completely exposed.” So apply those patches right away.

The research by Google also concluded that 42% of non-experts rate using anti-virus software as important and one of the top security precautions. How do the experts feel? Only seven percent consider that in the top three. This is because anti-virus on its own doesn’t defend against many of the threats today. It should be part of the overall security plan, but not used alone.