Patch management

Modern software, firmware, and operating systems are applications written with many millions of lines of code. It is easy to make mistakes and introduce bugs. New bugs for all kinds of applications are found daily and need to be addressed and fixed with updates and patches. Keeping regular IT systems and applications up to date with the latest firmware, software, and patch levels is already a daunting task, but things get even more complicated on an ICS network, especially down in the industrial zone.

Uptime requirements for critical ICS computer systems often don't allow them to reboot after updates—if updates are allowed to be installed at all. For those critical systems that are not allowed to be altered, a different approach to protecting them might be better. Systems such as these are prime candidates to have an application whitelisting solution deployed on them. We saw one example of a whitelisting solution, Microsoft's AppLocker, in the previous section and in an upcoming...