← VCE Software Development U4O2

Essential Eight: patching applications and operating systems

Two Essential Eight strategies: apply security updates to apps and operating systems promptly, with critical patches done fast, so known vulnerabilities are closed before attackers exploit them.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 92

Understanding Essential Eight: patching applications and operating systems in VCE Software Development U4O2

What it does: The code makes the timeframe depend on severity and active exploitation, matching the idea that critical patches must be applied fast. The loop checks every application against its latest patched version and installs the update, which closes known vulnerabilities. Patching applications and patching operating systems are two separate Essential Eight strategies. Both close known vulnerabilities by applying vendor security updates. The Essential Eight maturity model sets short timeframes for critical patches, such as 48 hours when exploits exist. Other patches are expected within about two weeks. Patch applications covers the applications in use, such as web browsers, office productivity software and PDF viewers. Attackers often exploit these as well.

Common mistakes: The comparison is the wrong way round. A critical patch is overdue when the hours waiting are greater than the limit, so it should be hours > limit. The loop uses os_update, which was never defined. It should loop over the list os_updates so every operating system update is installed.

Class: _____________________  ·  Name: _____________________  ·  Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Essential Eight: patching applications and operating systems to a class →

This module's key terms are also in a printable crossword (Modules 81–95) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning
Duo
Which two Essential Eight strategies deal with known vulnerabilities in software?
Application control and regular backupsPatch applications and patch operating systems
Matches
Delay all critical patches until the end-of-year maintenance window
↓
Critical patches need to be applied quickly (for example within 48 hours if exploited). Waiting months leaves a known vulnerability open to attackers.
Applying
Meanings
Term
patch applications and operating systems
Meaning
Two Essential Eight strategies: apply security updates to apps and operating systems promptly, with critical patches done fast, so known vulnerabilities are closed before attackers exploit them.
Practice
FOR EACH item IN apps + operating_systems
Testing
Gaps
IF patchReady isCritical THEN
Check Answer
Spots
3critical = True
4if critical and hours < limit:

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

The 'Flamingo' badge — Balanced Coder, one of Cloodit's 106 collectible badges
Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy
Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games
Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print
Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which two Essential Eight strategies deal with known vulnerabilities in software?
A. Patch applications and patch operating systems ✓
B. Application control and regular backups
Patching applications and patching operating systems are two separate Essential Eight strategies. Both close known vulnerabilities by applying vendor security updates.
2. What is the main purpose of applying a security patch?
A. Close a known vulnerability before an attacker exploits it ✓
B. Add new features so the software looks different
Security patches fix flaws that vendors have already identified. Attackers target unpatched systems because the flaw is publicly known.
3. A developer's laptop runs an operating system with a critical security update waiting. What does the Essential Eight expect?
A. Leave it, because operating systems only need updating once a year
B. Patch the operating system promptly, not wait for the next major release ✓
Patching operating systems means applying security updates promptly. Waiting leaves a known vulnerability open to attackers.
4. Which is the better timeframe for a critical patch where a working exploit already exists?
A. Within 6 months
B. Within 48 hours ✓
The Essential Eight maturity model sets short timeframes for critical patches, such as 48 hours when exploits exist. Other patches are expected within about two weeks.
5. Which statement about patching applications is correct?
A. It includes browsers, office suites and PDF readers, not just the operating system ✓
B. It only applies to software the organisation built itself
Patch applications covers the applications in use, such as web browsers, office productivity software and PDF viewers. Attackers often exploit these as well.

Match the Pairs

Patch applications → An Essential Eight strategy: apply security updates to software such as browsers, Office apps and PDF readers so known vulnerabilities are closed.
Patch operating systems → An Essential Eight strategy: apply security updates to Windows, macOS, Linux and server operating systems, and replace versions that no longer get updates.
Critical patches for a vulnerability being actively exploited should be applied within a very short timeframe, such as 48 hours, not left for the next monthly cycle → if patch.severity == "critical" and exploited: apply_patch(within_hours=48)
Patching closes a known vulnerability, so an unpatched system stays exposed to attackers who already know how to exploit the flaw → for app in installed_apps: if app.version < app.latest_patched: install_update(app)
Delay all critical patches until the end-of-year maintenance window → Critical patches need to be applied quickly (for example within 48 hours if exploited). Waiting months leaves a known vulnerability open to attackers.
Patch the apps but keep using Windows 7, which no longer gets updates → Operating systems must be patched too, and an unsupported OS gets no security fixes. It should be upgraded to a supported version.

Key Term

patch applications and operating systems
Two Essential Eight strategies: apply security updates to apps and operating systems promptly, with critical patches done fast, so known vulnerabilities are closed before attackers exploit them.

Fill in the Blanks

1. IF patchReady AND isCritical THEN applyPatch(app)
Hint: Type the logical operator that requires both conditions to be true.
2. IF exploitExists THEN deadlineHours ← 48
Hint: Type the number of hours allowed to apply a critical patch when an exploit already exists.
3. FOR EACH app IN appList IF app.version < latest THEN patch(app)
Hint: Type the comparison operator that detects an out-of-date application version.
4. FOR EACH device IN deviceList patchOS(device)
Hint: Type the keyword that links the loop variable to the list of devices being patched.
5. IF exploitExists THEN days ← 2 ELSE days ← 14
Hint: Type the keyword that gives the alternative timeframe when no exploit exists.

Spot the Error

Question 1
A limit = 48
B hours = 72
C critical = True
D if critical and hours < limit:
E print('Patch now')
Line D — The comparison is the wrong way round. A critical patch is overdue when the hours waiting are greater than the limit, so it should be hours > limit.
Question 2
A os_updates = ['KB1', 'KB2']
B for update in os_update:
C install(update)
Line B — The loop uses os_update, which was never defined. It should loop over the list os_updates so every operating system update is installed.
Question 3
A def patch_os(pc):
B pc.auto_update = False
C pc.reboot()
Line B — Setting auto_update to False turns off automatic operating system updates, so patches would be missed. It should be True so patches keep arriving.
Question 4
A if patch_available(app)
B install_patch(app)
C log('Patched ' + app)
Line A — An if statement needs a colon at the end of its line. It should be if patch_available(app):
Question 5
A critical = get_critical(apps)
B for app in critical
C patch_within(app, 48)
Line B — A for loop header must end with a colon. It should be for app in critical: so the patching line runs for each critical app.

Student with a class code? Join your class →