Essential Eight: patching applications and operating systems

Name:

Date:

Class:

Quick Questions

Shade in the A or B circle for each question.

1. Which two Essential Eight strategies deal with known vulnerabilities in software?

A Patch applications and patch operating systems

B Application control and regular backups

2. What is the main purpose of applying a security patch?

A Close a known vulnerability before an attacker exploits it

B Add new features so the software looks different

3. A developer's laptop runs an operating system with a critical security update waiting. What does the Essential Eight expect?

A Leave it, because operating systems only need updating once a year

B Patch the operating system promptly, not wait for the next major release

4. Which is the better timeframe for a critical patch where a working exploit already exists?

A Within 6 months

B Within 48 hours

5. Which statement about patching applications is correct?

A It includes browsers, office suites and PDF readers, not just the operating system

B It only applies to software the organisation built itself

Match the Pairs

Draw a line connecting each item on the left to its match on the right.

Left column		Right column
1Patch applications		AOperating systems must be patched too, and an unsupported OS gets no security fixes. It should be upgraded to a supported version.
2Patch operating systems		BAn Essential Eight strategy: apply security updates to software such as browsers, Office apps and PDF readers so known vulnerabilities are closed.
3Critical patches for a vulnerability being actively exploited should be applied within a very short timeframe, such as 48 hours, not left for the next monthly cycle		CAn Essential Eight strategy: apply security updates to Windows, macOS, Linux and server operating systems, and replace versions that no longer get updates.
4Patching closes a known vulnerability, so an unpatched system stays exposed to attackers who already know how to exploit the flaw		DCritical patches need to be applied quickly (for example within 48 hours if exploited). Waiting months leaves a known vulnerability open to attackers.
5Delay all critical patches until the end-of-year maintenance window		Efor app in installed_apps: if app.version < app.latest_patched: install_update(app)
6Patch the apps but keep using Windows 7, which no longer gets updates		Fif patch.severity == "critical" and exploited: apply_patch(within_hours=48)

Definitions

patch applications and operating systems

Fill in the Blanks

Complete each line of code by filling in the missing parts.

IF patchReady ___ isCritical THEN applyPatch(app)

IF exploitExists THEN deadlineHours ← __

FOR EACH app IN appList IF app.version _ latest THEN patch(app)

FOR EACH device __ deviceList patchOS(device)

IF exploitExists THEN days ← 2 ____ days ← 14

Spot the Error

Shade in the letter of the line that contains an error.

Question 1

A limit = 48

B hours = 72

C critical = True

D if critical and hours < limit:

E print('Patch now')

Question 2

A os_updates = ['KB1', 'KB2']

B for update in os_update:

C install(update)

Question 3

A def patch_os(pc):

B pc.auto_update = False

C pc.reboot()

Question 4

A if patch_available(app)

B install_patch(app)

C log('Patched ' + app)

Question 5

A critical = get_critical(apps)

B for app in critical

C patch_within(app, 48)

Answer Key

Essential Eight: patching applications and operating systems

Section A: Quick Questions

A — Patch applications and patch operating systems

A — Close a known vulnerability before an attacker exploits it

B — Patch the operating system promptly, not wait for the next major release

B — Within 48 hours

A — It includes browsers, office suites and PDF readers, not just the operating system

Section B: Match the Pairs

Patch applications → An Essential Eight strategy: apply security updates to software such as browsers, Office apps and PDF readers so known vulnerabilities are closed.

Patch operating systems → An Essential Eight strategy: apply security updates to Windows, macOS, Linux and server operating systems, and replace versions that no longer get updates.

Critical patches for a vulnerability being actively exploited should be applied within a very short timeframe, such as 48 hours, not left for the next monthly cycle → if patch.severity == "critical" and exploited: apply_patch(within_hours=48)

Patching closes a known vulnerability, so an unpatched system stays exposed to attackers who already know how to exploit the flaw → for app in installed_apps: if app.version < app.latest_patched: install_update(app)

Delay all critical patches until the end-of-year maintenance window → Critical patches need to be applied quickly (for example within 48 hours if exploited). Waiting months leaves a known vulnerability open to attackers.

Patch the apps but keep using Windows 7, which no longer gets updates → Operating systems must be patched too, and an unsupported OS gets no security fixes. It should be upgraded to a supported version.

Section C: Definitions

patch applications and operating systems — Two Essential Eight strategies: apply security updates to apps and operating systems promptly, with critical patches done fast, so known vulnerabilities are closed before attackers exploit them.

Section D: Fill in the Blanks

IF patchReady AND isCritical THEN
    applyPatch(app)

IF exploitExists THEN deadlineHours ← 48

FOR EACH app IN appList
    IF app.version < latest THEN patch(app)

FOR EACH device IN deviceList
    patchOS(device)

IF exploitExists THEN days ← 2
ELSE days ← 14

Section E: Spot the Error

D — The comparison is the wrong way round. A critical patch is overdue when the hours waiting are greater than the limit, so it should be hours > limit.

B — The loop uses os_update, which was never defined. It should loop over the list os_updates so every operating system update is installed.

B — Setting auto_update to False turns off automatic operating system updates, so patches would be missed. It should be True so patches keep arriving.

A — An if statement needs a colon at the end of its line. It should be if patch_available(app):

B — A for loop header must end with a colon. It should be for app in critical: so the patching line runs for each critical app.