| The organization (including any contractor to the organization) must promptly install security relevant software updates (e.g., patches, service packs, hot fixes). Flaws discovered during security assessments, continuous monitoring, incident response activities, or information system error handling, must also be addressed. Left un-patched, software may be vulnerable to a variety of exploits that could disclose sensitive information or lead to subsequent security breaches. An automated patch management system can mitigate this risk.
In the context of this IA control, automation is interpreted broadly and covers patch management systems that involve user acknowledgement of patches or user initiated patches after automatic notification of the availability of a patch. Automation is from the perspective of the commercial mobile device (CMD) user; system administrators may still need to perform several manual steps to prepare patches for distribution and modify CMD configuration to be able to receive patches.
However, patch systems that require CMD users to take additional steps beyond a one-step acknowledgment or request for the patch in order to locate, download, install, or verify the patch are not considered automated.
Some user involvement in the patch process is a defense-in-depth measure to protect CMD and DoD networks. In particular, it mitigates the risk of carrier-initiated patches that have been known to include malware.
Mobile device management (MDM) systems also mitigate the risk of un-patched CMD. If a user does not install a required patch for whatever reason, the MDM system may deny the CMD access to DoD networks and, when the risk warrants it, remotely disable the device. |
