How should I prioritise security updates on a server?
Prioritise updates by the risk of the affected component and the consequence of a failed change. An internet-facing vulnerable service may require a different response from an unused local package. The process should include identification, testing, installation and verification, not only downloading updates.
Before you start
- An accurate software inventory, vendor advisories and an agreed maintenance and recovery process.
Instructions
1. Determine what is actually affected
Match the advisory to the installed product, package build and configuration. Check whether the vulnerable feature is enabled and reachable, and whether exploitation is known. Consider the value of the data and privileges the service holds alongside the vendor’s severity rating.
2. Plan a proportionate response
Use the vendor-supported fix and evaluate compatibility in an appropriate test environment. Coordinate any restart, kernel reboot or dependency update. If a fix cannot be applied promptly, assess only documented mitigations with the service owner and record the remaining risk and deadline for the permanent update.
3. Verify the running result
After approved maintenance, confirm the installed version and whether the running process or kernel has loaded the change. Test authentication, application requests and scheduled work, and check monitoring for regressions. Keep the advisory, change record and validation result together for future review.
Check the result
- The affected running component is fixed or has an explicitly recorded temporary mitigation.
- The service passes its functional checks after the required restart or reboot.
Troubleshooting
- The package is updated but a scanner still reports exposure
- Compare the running process, restart state and vendor package guidance with the scanner’s evidence. A displayed upstream version alone may not establish the patch state of a distribution package.
Official references
Use the documentation for your installed version when a flag, service name or platform feature differs.