Patch Management

※ This item is a relaxed certification criterion (Annex 7-3) under the special provisions for information security management system certification. The certification criterion and key checkpoints above are the official relaxed/adjusted text; the detailed explanation, related laws, evidence, and nonconformity examples below are the "ISMS-P Certification Criteria Guide" content for Annex 7 [2.10.8 Patch Management], which belongs to the same control domain (under the relaxed criteria, this content applies within the scope of the certification criterion and key checkpoints above).

Patch management policies and procedures for OS and software shall be established and implemented according to the characteristics and importance of each asset, such as servers, network systems, security systems, and PCs.

• Patch application targets: servers, network systems, DBMS, applications, commercial software, open source, security systems, PCs, and the like
• Patch cycle: reflecting asset importance and characteristics
• Method of checking patch information
• Pre-review procedure before patch distribution
• Emergency patch application procedure
• Security review when a patch is not applied
• Patch officer and responsible person
• Contact information for patch-related vendors (manufacturers), and the like

For major servers, network systems, security systems, and the like, the status of installed OS and software patch application shall be periodically managed.

• Manage as a list so that version information, patch application status, and application dates per patch of the operating systems and software installed on major servers, network systems, security systems, and the like can be checked
• Periodically check whether the latest security patches need to be applied

※ Sites for checking the end of service support (EOS or EOL) date by major OS (examples)

• MS Windows: https://support.microsoft.com/ko-kr/lifecycle/search
• Red Hat Linux: https://access.redhat.com/support/policy/updates/errata
• CentOS: https://wiki.centos.org/About/Product
• AIX: https://www-01.ibm.com/support/docview.wss?uid=isg3T1012517
• HP-UX: https://hpe.com/info/hpuxservermatrix
• Solaris: https://www.oracle.com/technetwork/server-storage/solaris/overview/releases-jsp-140987.html

Where applying the latest patches to remediate vulnerabilities is difficult due to service impact or similar factors, supplementary measures shall be established.

• Applying patches to an operational system may affect system availability, so apply patches only after sufficiently analyzing the impact through impact analysis and similar steps in accordance with the defined procedure, taking into account the importance and characteristics of the operational system
• Where immediate patch application is difficult depending on the operating environment, establish the reason and additional supplementary measures, report them to the responsible person, and manage their status

For major servers, network systems, security systems, and the like, patching via public internet access shall be restricted.

• However, where unavoidable, establish protective measures through prior risk analysis and apply them after approval by the responsible person

Where a patch management system (PMS) is used, it may be exploited as a malicious code distribution point targeting internal network servers or PCs, so sufficient protective measures such as access control shall be established for the patch management system server, management console, and the like.

• Access control measures for the patch management system itself: blocking access by anyone other than authorized administrators, changing default passwords, removing security vulnerabilities, and the like
• Integrity checks of files when distributing update files, and the like