"Remind me tomorrow." It's probably the most-clicked button in the history of computing. Updates always arrive at the wrong moment, ask for a restart and sometimes change something you were used to. Yet they are one of the most effective and cheapest defences there is. It's worth understanding why.
What an update contains
An update can bring three different things:
- new features, which you may not even want;
- bug fixes, which improve stability;
- security fixes, which close vulnerabilities discovered in the software.
It's the last of these that makes the difference. A vulnerability is a flaw that lets someone do what they shouldn't: run code, read data, gain privileges. When the vendor publishes the fix, it also implicitly reveals that the flaw exists. From that moment attackers can study the fix to work out how to hit systems that haven't installed it yet. The time between the patch being released and you installing it is the window of risk, and it depends entirely on you.
The vulnerabilities actually exploited
The most feared attacks are not those based on unknown flaws, which are rare and expensive. Most incidents exploit vulnerabilities that have been known for some time, for which the fix already existed. That's good news: it means updating regularly removes a large part of the risk.
The devices people forget
Everyone thinks about the computer and the phone. Far fewer think about:
- home or office routers and modems;
- NAS devices and network drives;
- IP cameras, smart doorbells, thermostats, smart plugs;
- network printers;
- business firewalls and VPNs;
- website and CMS plugins and themes;
- browser extensions;
- programs installed years ago and never opened again, such as PDF readers or old runtime versions.
These devices often stay on for years, are reachable from the network and show no update warning at all. It's worth checking the admin panel or the manufacturer's app from time to time.
End of support
Every product eventually stops receiving fixes. An operating system or a phone that is out of support keeps working, but every newly discovered vulnerability will stay open forever. That's why it matters to know the end-of-support date of the devices you use and plan replacements in good time, especially for those used for banking, work and email.
For smartphones, when you buy one it's worth checking how many years of security updates the manufacturer states for that model: the difference between devices can be considerable.
How to organise it at home
- Turn on automatic updates for the operating system, browser, phone apps and app store.
- Restart your computer at least once a week: many fixes are applied only on restart, and leaving a laptop in sleep mode for months postpones them indefinitely.
- Check the router every few months, or enable automatic updates if available.
- Uninstall programs you no longer use: a program that isn't there can't be vulnerable.
How to organise it in a small office
- Keep a simple inventory, even a spreadsheet, listing every device, the system installed and its end-of-support date.
- Set a fixed window for updates, for example one evening a week, so that restarts don't interrupt work.
- Give priority to systems exposed to the internet: firewalls, VPNs, mail servers, websites. For these, critical fixes should be applied as soon as possible.
- Before updating critical business software, make sure you have a recent backup and, if possible, test the update on a single workstation first.
"What if the update breaks something?"
It happens, but rarely, and it's a manageable risk with backups and a little caution on critical systems. The opposite risk, staying exposed to a known and actively exploited vulnerability, is usually far more serious. If an update causes problems, the answer is to report it, wait for the fix and in the meantime reduce the system's exposure, not to disable updates forever.
Beware of fake updates
A pop-up on a website saying "Your browser is out of date, download the update" is almost always a trap. Legitimate updates come from the operating system, the app store or the program's own menu, not from windows that appear while you browse.
In short
- Security fixes close vulnerabilities that attackers study as soon as they're published.
- Most attacks exploit known flaws for which a patch already existed.
- Routers, NAS devices, cameras, printers and plugins need updating just like computers and phones.
- An out-of-support device should be replaced, especially if used for banking and work.
- Automatic updates and regular restarts solve most of the problem.