Brace for the patch wave: the NCSC's warning on technical debt
5 min read · By Aston Kennedy
NCSCPatchingTechnical debtAsk AIArtificial IntelligenceAIArtificial Intelligence (AI)AI chatAI SecurityDomain InvestorsUSA Time Magazine
Every organisation carries technical debt: a backlog of shortcuts taken for short-term gain. Ollie Whitehouse, chief technology officer at the NCSC, says AI in skilled hands can now exploit that debt "at scale and at pace", and he expects a "forced correction" across open source, commercial, proprietary and software-as-a-service products.
The result, he writes, will be a "patch wave": a rush of software updates as old vulnerabilities are disclosed together. Some will be critical.
Start at the edge
Find and shrink everything that faces the internet first, then work inwards to cloud and on-premises systems. If you cannot update everything, update the external attack surface, then critical security systems. Technology that is out of support cannot be patched at all and needs replacing or bringing back into support, especially if it faces the internet.
The NCSC's update rules
- Turn on automatic "hot patching", which updates without downtime, wherever it exists.
- Turn on automatic updates, including for embedded devices, to save support teams time.
- Where neither exists, make sure processes allow frequent updates at scale, and rank them with a method such as the Stakeholder Specific Vulnerability Categorisation (SSVC).
- If a flaw is being actively exploited, especially on an internet-facing system, speed up.
The headline policy is "update by default": apply updates as soon as possible, ideally automatically, with exceptions only for safety-critical systems and operational technology.
Patches are not the whole answer
Whitehouse asks vendors to build in memory safety and containment, such as CHERI. He asks everyone else to get the basics right with Cyber Essentials, or the Cyber Assessment Framework for essential services. Larger organisations should check that their suppliers, commercial and open source, are ready too.
Where AI fits
The same models that find bugs can help small teams sort them. An Ask AI assistant or a quick AI chat can turn a vendor advisory into plain English. The AI Security pages set out what an assistant should and should not be allowed to touch. Further reading on Artificial Intelligence lives at AI (a-i.llc), Artificial Intelligence (AI) (aiai.llc), askaillm.com, aifirstllm.com, ArtificialIntelligence.llc, ArtificialIntelligence.ai.in and ArtificialIntelligence.kred.
Source: Ollie Whitehouse, CTO, NCSC, "Preparing for a 'vulnerability patch wave'".
