How Often Do You Install Security Patches?
This week, on March 12th, we got another .NET 8 update with the release of .NET 8.0.3.
It contains two important security fixes for denial of service vulnerabilities. Those vulnerabilities are also present in .NET 7, so make sure to update your applications.
This takes me to the question:
​How often do you install security patches in your applications?
As software developers, we are deeply invested in the development cycle of an application.
However, once the application is installed on the production system, we often step back, and the operations teams take over.
While we care about security during development and need to fulfill non-functional requirements about authentication and authorization, it all shifts as soon as the application is live.
What does your security patch policy or your update schedule look like?
I have worked for a company that deals with important data. Because of internal processes and customer request, they only installed new major versions once per year.
On a schedule like that, you’ll most likely want to have a process that defines when and how often you want to update your dependencies and install security fixes on your production systems.
I don’t think there is a right or wrong here.
But what’s definitely wrong is not having a strategy and not installing security patches at all. Everything else is a step in the right direction.
For the projects I build with my own software company, we tend to ship security patches with the next regular software update.
Our schedule is usually 2-3 months between software updates.
This way, we do not have extra effort installing new versions “just” because of security patches. On the other hand, it doesn’t take too long until the next fixes are deployed.
Even though it might not be on top of your priority list, consider thinking about security patches and how you deal with them in your company.
Maybe you can improve the process?
If you haven’t watched it already, you might want to familiarize yourself with the three new LINQ methods coming with .NET 9.
PREMIUM CONTENT
