Patch Management

Scope

What this is: Assessing, prioritizing, and deploying security patches to remediate known vulnerabilities in systems and applications.

Competition relevance: Infrastructure hardening and defensive operations (blue team). Core defensive hardening skill.

Why it matters: Unpatched systems are the most common entry point for attackers. Competition scenarios require identifying and remediating vulnerable software.

WSOS 2026 alignment: This topic directly supports Section 4: Secure systems operation and maintenance (maintaining system security through patching) and Section 5: Secure systems protection and defence (reducing attack surface by fixing vulnerabilities).

Competition area: Core to the infrastructure hardening area and the defensive operations area, where you assess, prioritise, and deploy security patches to remediate vulnerabilities.

Offline competence: Package managers (apt, yum, dnf, Windows Update) can work with local repositories. Use offline WSUS or apt mirrors. Vulnerability databases (NVD, CVE) should be downloaded for offline reference. Maintain offline patching checklists and CVSS scoring guides.

Competency Matrix

Level	Expectation
Regional	Apply Windows Update / apt update manually.
National	Prioritize patches. Handle rollbacks. Test before deployment.
Squad/Team Selection	Emergency patching procedures. Zero-day mitigation.

---

Technical Content

Windows Patching

Windows Update:

# Check for updates
Get-WindowsUpdate

# Install all updates
Install-WindowsUpdate -AcceptAll -AutoReboot

# Install specific KB
wusa.exe Windows10-KB1234567-x64.msu /quiet /norestart

WSUS (domain):

# Force check-in
wuauclt /detectnow /updatenow

# Or PowerShell
Invoke-WUJob -Script {ipmo PSWindowsUpdate; Get-WindowsUpdate -AcceptAll -Install}

---

Linux Patching

Debian/Ubuntu:

apt update
apt list --upgradable
apt upgrade -y package-name

# Or full upgrade
apt dist-upgrade

RHEL/CentOS:

yum check-update
yum update package-name

---

Prioritization

Criteria:

1. CVSS score (10 = critical)
2. Exploited in wild?
3. System exposure (internet-facing vs internal)
4. Business impact

Example:

• Critical: RCE in internet-facing web server (patch immediately)
• High: Local privilege escalation (patch within 24h)
• Medium: DoS vulnerability (schedule)

---

Testing

Pre-deployment:

1. Test on non-production system
2. Verify application compatibility
3. Have rollback plan

---

Rollback

Windows:

# Uninstall update
wusa /uninstall /kb:1234567

Linux:

# Downgrade package
apt install package-name=previous-version

---

Competition Strategy & Marking

What gets marked:

• See specific task requirements

Evidence and reporting requirements: Evidence and reporting requirements:

• Screenshot showing vulnerable software versions before patching (dpkg -l, rpm -qa, wmic product get name,version)

• Screenshot showing available security updates identified (apt list —upgradable, yum list updates, Get-WindowsUpdate)

• Prioritisation matrix or notes showing CVSS scores and patch priority decisions

• Screenshot showing patch installation in progress or completion message

• Screenshot showing updated software versions after patching (verify version numbers match expected patched versions)

• For Windows: screenshot showing successfully installed updates (Get-HotFix, Windows Update history)

• Reboot verification if required (uptime showing recent restart, services confirmed running post-reboot)

• Written explanation of prioritisation decisions based on CVSS severity and system criticality

• Clear file naming: patch_before_vuln_versions.png, patch_priority_cvss.png, patch_after_updated.png

• Prioritize patches for exploited vulnerabilities

• Document patch deployment

• Verify service still functions

• Time limit: 30 minutes for patching tasks

Time-boxed drill suggestion: 40-minute patch management sprint: Given vulnerable Ubuntu and Windows systems, enumerate all installed software and versions, identify available security updates, research CVE severity scores for identified vulnerabilities, prioritise patches using CVSS (Critical >9.0 first, then High >7.0), apply high-priority patches using apt and Windows Update, verify successful installation with version checks, reboot systems if kernel/critical updates require it, and document complete patching workflow with before/after version screenshots and CVSS-based prioritisation justification. This drill can be done offline with local package repositories or WSUS.

---

False Flags / Wrong Paths

Common Traps

Time-consuming rabbit holes If a single approach takes more than the allocated time-box, reassess and try alternative methods or move to next task.

Over-complication Competition scenarios test core skills. If solution seems overly complex, look for simpler approach.

---

Practice Checklist

• Can complete core tasks without documentation
• Understand key concepts and techniques
• Can document findings with proper evidence format
• Can complete realistic scenarios within time limits

---

References

Primary references:

• WSOS 2026: the sections this page supports are listed under Scope
• Competition stage roadmap: See ../../00-roadmaps/[stage].md

Related topics in this knowledge base:

• Cross-reference related topics as appropriate

External resources (for offline preparation):

• Tool documentation: man pages, —help flags, /usr/share/doc
• Maintain offline copies of key references