Why You Should Keep Your Software Patched

Face it, software isn't perfect. It's bad enough that bugs in the code occasionally make a program crash just when you were about to defeat the final boss and finish the level. What's worse is that hordes of cyber criminals are constantly seeking flaws in operating systems and other software, vulnerabilities that will let them steal your passwords, install malware, and otherwise give you grief. The bad guys find a hole, the good guys release a patch, and you, the user, had darn well better install that patch.

Operating Systems
If you're using Windows, you absolutely must turn on Automatic Updates to get all the important security patches. It's worthwhile to occasionally visit http://windowsupdate.microsoft.com and see what non-critical updates are available. "But I heard that a bad update damaged some PCs," you say? That was years ago. Let it go, move on, and turn on Automatic Updates. Turning on Automatic Updates protects all your Microsoft software, including Office.

Mac users need to shape up too. Yes, Apple was slow with the patch for the vulnerability that permitted last month's massive Flashback infestation, but even after that patch came out researchers determined that all too many users didn't apply it. Others who upgraded to Mac OSX 10.7 Lion but didn't update the FileVault encryption tool left passwords exposed due to a coding error. Mac users who get their software through the Mac Apps store should download all available updates, or at the very least all the security-related updates. It's a relatively painless process, thanks to the centralization.

Browsers
Your browser provides entry for websites around the world into your computer, including unsavory sites. A browser vulnerability may let cyber criminals install malicious add-ons, capture your passwords, or perform many other dastardly deeds.

Internet Explorer gets updated as part of Automatic Updates. Chrome downloads updates automatically and applies them the next time you restart the browser; you can also actively install an update when the wrench icon shows that one is available. Firefox also downloads updates automatically and installs on restart. If an update has been sitting around for 24 hours it will pop up a notification. To be sure you're up to date, open the browser's About box. Firefox and Chrome automatically check for updates when you do so.

Browser Plug-ins
Toolbars, browser helper objects, and other plug-ins hook deeply into the browser. An attack that compromises a plug-in can do almost as much damage as a browser-based attack. Firefox users can visit the Check Your Plugins page to identify outdated ones and get updates.

Chrome users can ensure that all extensions are up to date using a normally hidden button. On the Extensions page, check the box for Developer mode. This reveals a button titled "Update extensions now." Still using Internet Explorer? You'll need to check add-ons individually for new versions.

Adobe Reader and Flash Player have been particular targets of cyber criminal attack. To be sure your Adobe products are fully patched, visit http://www.adobe.com/downloads/ and click the links for any readers and players you have installed. This will either confirm that you have the latest or offer to install the latest.

Security Software
It really shouldn't be necessary to say this, but you must make sure to use the very latest version of your antivirus or security suite. The bad guys invent new tricks, and the good guys invent new fixes. If you're using an old security tool you don't have the new fixes. And of course you'll want to receive new antivirus definitions automatically, the instant they're ready.

If you make certain to keep these essential programs up to date, you should stay safe from most known threats. There's still the problem of zero-day threats, ones for which a patch hasn't yet been created. However, plenty of outdated attacks still succeed against unpatched systems. Don't be one of those victims. For even stronger protection, run a patch management tool to check all of your applications for available updates.

About Our Expert

Neil J. Rubenking

Principal Writer, Security

My Experience

When the IBM PC was new, I served as the president of the San Francisco PC User Group for three years. That’s how I met PCMag’s editorial team, who brought me on board in 1986. In the years since that fateful meeting, I’ve become PCMag’s expert on security, privacy, and identity protection, putting antivirus tools, security suites, and all kinds of security software through their paces.

Before my current security gig, I supplied PCMag readers with tips and solutions on using popular applications, operating systems, and programming languages in my "User to User" and "Ask Neil" columns, which began in 1990 and ran for almost 20 years. Along the way, I wrote more than 40 utility articles, as well as Delphi Programming for Dummies and six other books covering DOS, Windows, and programming. I also reviewed thousands of products of all kinds, ranging from early Sierra Online adventure games to AOL’s precursor Q-Link.

In the early 2000s, I turned my focus to security and the growing antivirus industry. After years of working with antivirus, I’m known throughout the security industry as an expert on evaluating antivirus tools. I serve as an advisory board member for the Anti-Malware Testing Standards Organization (AMTSO), an international nonprofit group dedicated to coordinating and improving testing of anti-malware solutions.

The Technology I Use

Much of the testing I do, particularly testing with real-world ransomware, is just plain dangerous. To perform such tests safely, I sequester them inside virtual machines managed by VMWare Workstation. For cross-platform testing, I use a MacBook Air, a Google Pixel 4, and a 6th-generation iPad.

I rely on my Delphi coding skills to create and maintain small applications. These include programs to check whether an antivirus correctly handled the malware it detected, launch dangerous URLs and record the security program’s reaction, and analyze the malware that I collect for use in testing. I also wrote a tiny browser and text editor for use in testing security apps that have predefined reactions for known products.

I do my writing and research on a Dell OptiPlex desktop, relying on Microsoft Word (my fingers know all the shortcuts). Many of my articles include charts and analysis; Excel is my go-to for those. When work hours end, though, I escape the bounds of Microsoft and Windows. There’s an iPhone in my pocket, I relax with my oversized iPad, and my Kindle Oasis is always loaded with the best science fiction and fantasy.

Read the latest from Neil J. Rubenking

Read full bio