The concept
Software defects can create opportunities for unauthorized access or disruption. Security updates address some of those defects. A device that appears to work normally may still be exposed. Keep an inventory of supported software, enable appropriate automatic updates, and check that important devices actually receive them rather than assuming the setting covers everything.
Worked example
A fictional small theater updates office laptops but forgets an old tablet used at the entrance. The tablet runs an unsupported operating system and stores an administrator's session. The theater identifies the gap during an inventory, removes unnecessary access, and replaces the unsupported device. The improvement comes from knowing what exists and what remains supported, not merely from clicking an update button on the newest computer.
Limits and judgment
Updates can occasionally disrupt compatibility. For a critical system, plan a reasonable testing and recovery process without allowing indefinite postponement. Confirm completion and restart where required. Updating applications alone may leave operating systems, browsers, plugins, or network equipment behind. Prioritize the devices and services whose compromise would cause the most serious harm, while maintaining a documented routine for the rest.
FROM UNDERSTANDING TO ACTION
Put it to work.
List five kinds of software or devices that a small community organization might forget to update.
RETRIEVE. REASON. REMEMBER.
Knowledge check.
Choose one answer for each question, then check your reasoning.
Sources & further reading.
Links support the core concepts or identify the book. Examples, exercises, and critical analysis are original Institute material. Source checks are not an independent expert review of every claim.
- NIST: Securing Data & Devices ↗
Security or privacy principle; the fictional scenarios and operational analysis are original. Source reviewed 2026-10-19.