| Mức độ rủi ro | Tiêu chí | Cadence (SLA) | Ví dụ |
|---|
| Emergency / Zero-Day | KEV + Exploit in Wild + Internet-facing / Crown Jewel | 0 - 72 giờ | Log4Shell, ProxyLogon, PrintNightmare, CitrixBleed |
| Critical | CVSS ≥ 9.0, hoặc KEV, hoặc RCE/Authentication Bypass | 7 - 14 ngày | Microsoft Patch Tuesday Critical, Linux Kernel RCE |
| High | CVSS 7.0-8.9, Internet-facing, Privilege Escalation | 14 - 30 ngày | Apache HTTPd, OpenSSL, Windows High vulns |
| Medium | CVSS 4.0-6.9, Internal only, Info Disclosure | 30 - 60 ngày | Denial of Service local, Info Leak |
| Low | CVSS < 4.0, Low exploitability | 90 ngày / Next MW | Minor bug, UI issue |
| Firmware / Hardware / IoT / OT | Vendor release, Maintenance window lớn, Downtime tolerance thấp | 60 - 180 ngày (Planned) | BIOS, Switch/Firewall/Router Firmware, PLC, Medical Device |
| KPI | Công thức | Target (Mature Org) |
|---|
| Mean Time to Patch (MTTP) - Critical | Avg(Deploy Date - Patch Release Date) cho Critical vulns | < 7 ngày (Best: < 72h) |
| Patch Compliance Rate | Patched Assets / Total Applicable Assets × 100% | > 95% (Critical), > 90% (High) |
| Patch Coverage | Assets with Agent/Scanner / Total Known Assets | 100% (Managed assets) |
| Exception Rate | Approved Exceptions / Total Vulns | < 5%, có expiry & review |
| Rollback Rate | Rollback Deployments / Total Deployments | < 2% |
| Reboot Compliance | Rebooted Assets / Assets Requiring Reboot | > 95% trong MW |
| Vulnerability Age (Critical) | Max(Current Date - Patch Release Date) cho unpatched Critical | 0 ngày (Emergency), < 14 ngày (Critical) |
| Loại | Công cụ | Đặc điểm |
|---|
| Endpoint/Server (On-prem/Cloud) | Microsoft SCCM/Intune, Red Hat Satellite, Ubuntu Landscape, SUSE Manager, AWS SSM Patch Manager, Azure Update Manager, GCP VM Manager, Automox, Tanium, Qualys Patch Management, Ivanti | Agent-based, Cross-platform, Scheduling, Reporting, Rollback |
| Container / Kubernetes | Kyverno, Gatekeeper, Kubewarden (Admission Control), Renovate/Dependabot (Base Image Update), Trivy/Grype (Scan), ArgoCD/Flux (GitOps Deploy) | Image-based, Immutable, GitOps, Admission Policy |
| Application / Library (SCA) | Dependabot, Renovate, Snyk, WhiteSource/Mend, JFrog Xray, Sonatype, FOSSA | SBOM, Transitive dep, Auto PR, License + Vuln |
| Firmware / Hardware | Dell OpenManage, HPE OneView, Lenovo XClarity, Cisco Intersight, Supermicro SFT, Redfish API | Out-of-band, Hardware-specific, Scheduled |
| Vulnerability Intelligence | CISA KEV, NVD, EPSS (FIRST), Vendor Advisory, Vulners, Tenable, Qualys, Rapid7, Kenna/VMware Carbon Black, ServiceNow VR | Prioritization, Exploit availability, Threat context |
| Thách thức | Giải pháp |
|---|
| Legacy App không tương thích patch mới | App virtualization, Containerization, Compensating Control (WAF, Micro-seg, Network Filter), Vendor Extended Support (ESU), Risk Acceptance có hạn |
| Maintenance Window hẹp, Downtime không cho phép | Live Patching (KernelCare, Kgraft, Oracle Ksplice, Azure Live Patching), Blue/Green, Canary, Rolling Update, HA Pair Failover |
| Số lượng vuln quá lớn (Noise) | Risk-based Prioritization (KEV, EPSS, Asset Criticality, Exploitability, Reachability Analysis), Focus top 5-10% risk |
| Third-party / Vendor dependency | Contractual SLA patch, Vendor Security Assessment, SBOM requirement, Escape Hatch (Isolation) |
| OT/ICS không thể patch thường xuyên | Purdue Model Segmentation, Unidirectional Gateway (Data Diode), Application Whitelisting, Network Monitoring (Nozomi, Claroty, Dragos), Virtual Patching |
Patching Cadence & Compliance Frameworks
- PCI DSS 4.0 Req 6.3.3: Critical patch within 30 days (Best practice: 72h cho Internet-facing)
- NIST SP 800-53 Rev 5 SI-2: Flaw Remediation – "Timeframes based on risk"
- ISO 27001:2022 A.8.8 / A.12.6: Management of technical vulnerabilities – Timely patching
- CISA Binding Operational Directive (BOD) 22-01: Federal Civilian Agencies – KEV patch within 2 weeks (Critical) / 4 weeks (High)
- SOC 2 Type II CC7.1: Vulnerability identification & remediation tracking
Tóm lại: Patching Cadence không chỉ là "định kỳ patch" – là quy trình quản trị rủi ro dựa trên đám mây (risk-based) có SLA rõ ràng, tự động hóa, đo lường, và cải tiến liên tục. Tổ chức thành熟 (mature) đạt MTTP Critical < 7 ngày, Compliance > 95%, Exception < 5%. Đầu tư vào Asset Inventory, Risk-based Prioritization (KEV/EPSS), Automation (IaC/GitOps), và Compensating Controls cho Legacy/OT là chìa khóa.
