Software has flaws
Modern software is made of millions of lines of code written by many people, and mistakes are inevitable. Some mistakes only cause bugs, such as a button that does not work. Others are security vulnerabilities, meaning flaws that an attacker could use to run code, read data or take control of a device.
Vulnerabilities are found by the vendors themselves, by independent researchers, and sometimes by attackers. When a flaw is found, the vendor writes a fix and releases it as an update, often called a patch. Installing the update closes that particular hole.
The window of exposure
The key concept is the gap between a fix being released and you installing it. During that window, the flaw is not secret anymore. A security update’s release notes, or the changes themselves, can show attackers where the weakness is. Attackers often build tools to exploit a published flaw and scan the internet for systems that have not yet been patched. People who are slow to update are therefore exposed to a problem that is, in effect, publicly known.
There is also a different kind of case, where attackers find a flaw before the vendor does, so no fix exists yet. These are sometimes called zero-day flaws. They are less common than attacks on known flaws and are mostly used against particular targets. For ordinary users, the practical lesson is that updating promptly removes the larger and more common risk.
What kinds of attacks updates stop
Updates can protect against several outcomes:
- Malware infection through a web page or file that exploits a browser, document reader or operating system flaw.
- Account and data theft when a flaw lets software read information it should not.
- Remote takeover of devices such as routers, cameras and servers exposed to the internet.
- Ransomware attacks, which sometimes begin by exploiting an unpatched system. Updates are not the only defense, which is why data backups still matter.
Many large breaches in the past have involved flaws for which a fix already existed but had not been applied. That is one reason organizations take patching seriously, and why individuals should too.
What needs updating
Security is only as strong as the oldest part of your setup, so it helps to think broadly:
- Operating systems on phones, tablets and computers.
- Web browsers and their extensions, since they handle untrusted content all day.
- Apps, especially those that open files or connect to the internet. App stores typically distribute updates to apps you installed from them.
- Routers and other connected gadgets, including smart speakers, cameras and TVs. These often get less attention but sit on your network all the time.
- Firmware inside devices such as printers or modems, which may need a manual check.
- Security tools such as antivirus programs, if you use them.
Why people delay, and what to do about it
Common reasons for postponing updates are real: they interrupt work, take time, use data, and occasionally cause problems such as a changed layout or, rarely, a bug in the new version. A few approaches reduce the friction:
- Turn on automatic updates for the operating system, browser and apps. This removes the need to remember.
- Schedule restarts for a time when you are not busy, such as overnight, because many updates only complete after a reboot.
- Back up first if you are worried about a major version change.
- Update on a trusted network and from official sources only. Be wary of pop-ups on websites that claim your software is out of date and offer a download, since fake update prompts are a known way to spread malware.
- Do not leave it for months. Even a week or two of delay is better than none, but shorter is safer.
When updates stop coming
Every product has a support period. After it ends, the vendor stops releasing security fixes, and any flaws found later stay open. Running an unsupported operating system, a phone that no longer receives updates, or an old router becomes riskier over time. The end of device support is a common surprise for owners of gadgets that seem to work perfectly well.
If a device is out of support, your options include:
- Replacing it, particularly if it holds sensitive data or sits at the edge of your network.
- Limiting what you do with it, for example avoiding banking on an old phone.
- Keeping it off the internet if it does not need to be online.
- Checking whether the maker offers an extended support option.
When buying new devices, it is reasonable to check how long the maker promises updates, since that affects how long it will be safe to use.
Updates are not a complete defense
Patching does not protect you from being tricked into giving away a password or approving a malicious request. It works alongside strong unique passwords, a second sign-in step and cautious habits. Still, it is one of the cheapest and most effective steps available, because it fixes problems you could not otherwise fix yourself. When the notification appears, installing it is usually worth the few minutes.