Updates

Overview

The first and most impactful hardening step is keeping software updated. This lesson revisits updates from a hardening perspective — as a deliberate, ongoing security control rather than an occasional chore — and introduces automatic security updates.

Learning objectives

• Explain why patching is the foundation of hardening.
• Describe automatic/unattended security updates.
• Balance patch speed against stability.

Core concept

Patching closes known vulnerabilities before attackers can exploit them, and it is consistently among the highest-value security measures. From a hardening standpoint:

• Apply security updates promptly — these fix flaws that are often publicly known and actively targeted.
• Enable automatic/unattended security updates where appropriate (e.g. unattended-upgrades on Debian/Ubuntu, dnf-automatic on Fedora/RHEL) so critical patches are not delayed by human oversight.
• Track and update all software, including third-party packages and dependencies, not just the base OS.

How it works

A hardening process treats patching as a continuous control: security updates are applied on a short cadence (ideally automatically for critical fixes), while larger upgrades on important systems are tested first to avoid breaking changes. Automatic security updates apply the narrow set of security-relevant patches without full system upgrades, giving fast protection with low risk. The goal is to minimize the window of exposure between a vulnerability becoming known and being patched on your systems.

Practical example

On Ubuntu, enabling unattended security upgrades means the system installs security patches on its own, closing known holes without waiting for an administrator. An admin still reviews larger apt upgrade changes on critical servers, testing before rollout. The result: routine security fixes land quickly and automatically, while riskier changes remain controlled.

Cybersecurity relevance

Unpatched, known vulnerabilities are one of the most common ways systems are compromised — attackers scan the internet for outdated software with public exploits. Prompt patching directly removes these easy wins, making it the single most cost-effective hardening measure. Assessments routinely flag missing updates as findings; a system with automatic security updates and a tracked patch process is dramatically harder to compromise through known flaws.

Common mistakes

• Delaying security patches, leaving a wide window of exposure to known exploits.
• Patching only the base OS, ignoring third-party software and dependencies.
• Never testing critical upgrades, risking outages — balance speed with controlled testing for important systems.

Key takeaways

• Prompt patching is the foundation of hardening — it closes known, actively exploited vulnerabilities.
• Enable automatic/unattended security updates for fast, low-risk protection; test larger upgrades on critical systems.
• Track all software (including third-party and dependencies) and minimize the exposure window between disclosure and patch.

Check your understanding

• Why is patching considered one of the highest-value hardening measures?
• What is the benefit of automatic security updates, and where should larger upgrades still be tested first?