← VCE Software Development U4O2

Patch management

The regular, planned process of finding, testing and installing updates that fix known vulnerabilities in software, including libraries and frameworks.

Part of: VCE Software Development - U4O2 - Cyber Security: secure software development practices — Module 64, ACARA Digital Technologies Years 9–10 — Cyber Security Threats and Vulnerabilities — Module 66, WA Computer Science ATAR Year 11 — Cyber Security — Module 180

Understanding Patch management in VCE Software Development U4O2

What it does: The patch goes to the testing environment first and only reaches production if the tests pass. Scheduling updates for a set day and a quiet time makes patching regular and planned, with less disruption to users. Patch management is planned and ongoing. Waiting until after an attack leaves known vulnerabilities open to exploitation. Testing patches first checks that they don't break the software before they reach real users. A schedule makes patching predictable and consistent, so vulnerabilities do not stay open for long. Third-party libraries and frameworks can contain known vulnerabilities, so they must be patched too. Tracking what is installed lets a team quickly see what is affected. Older versions are often the most at risk.

Common mistakes: A library needs patching when the installed version is different from the latest version. The condition should use != so needs_patch becomes True when the versions differ. A patch should only be released to the live server if the tests passed. The line should be if passed: so that failing patches are not released.

Class: _____________________ · Name: _____________________ · Date: _________

Free printable worksheet with full answer key — or add this module to a class and your students practise it interactively.

🖨 Print worksheet + answer key Add Patch management to a class →

This module's key terms are also in a printable crossword (Modules 49–72) and word search (Modules 49–130).

Take this worksheet further — free with Cloodit

Each concept is reinforced from every angle — learned, then applied, then tested.

Learning

Duo

Which best describes patch management?

A regular, planned process of finding, testing and installing updates that fix known vulnerabilitiesInstalling an update only after a system has already been attacked

Matches

install_patch("production") # no testing done

↓

The patch is installed straight onto production without being tested first, so it could break the software or cause downtime.

Applying

Meanings

Term

patch management

Meaning

The regular, planned process of finding, testing and installing updates that fix known vulnerabilities in software, including libraries and frameworks.

Practice

inventory ← list of installed software and versions

Testing

Gaps

pip --outdated

Check Answer

Spots

3needs_patch = False

4if installed == latest:

Cloodit turns curriculum-aligned coding content into journeys students work through one biome at a time.

Students earn collectable badges

Over 100 of them, across seven natural biomes.

Study Buddy

Students build a real study resource

Turns their work into revision material ready for Flash Cards and Exam study.

Diamond Dash — one of Cloodit's live, competitive Sprint games

Students lock in with Sprints

Live, competitive practice for the start of the lesson or a teacher-led lesson finisher.

A Cloodit certificate of achievement, ready to personalise and print

Custom printable certificates

Honour your top performers, or encourage a student who's trying hard — ready to print in seconds.

Add to class →

Quick Questions

1. Which best describes patch management?

A. A regular, planned process of finding, testing and installing updates that fix known vulnerabilities ✓

B. Installing an update only after a system has already been attacked

Patch management is planned and ongoing. Waiting until after an attack leaves known vulnerabilities open to exploitation.

2. A patch has just been released for the web framework your team uses. What should happen first?

A. Install it straight onto the production server

B. Test the patch in a testing environment before release ✓

Testing patches first checks that they don't break the software before they reach real users.

3. Which is a good approach to scheduling updates?

A. Apply patches randomly whenever someone remembers

B. Set a regular patching schedule and apply urgent security fixes as soon as they are tested ✓

A schedule makes patching predictable and consistent, so vulnerabilities do not stay open for long.

4. Which statement about patching is true?

A. Libraries and frameworks used in a project need patching as well as the operating system ✓

B. Only the operating system ever needs patching

Third-party libraries and frameworks can contain known vulnerabilities, so they must be patched too.

5. Why does a team keep a list of the software and versions it has installed?

A. So it knows which systems and components need a patch when a vulnerability is announced ✓

B. So it can skip patching versions that have been installed for a long time

Tracking what is installed lets a team quickly see what is affected. Older versions are often the most at risk.

Match the Pairs

npm audit → Checks a project's libraries and frameworks for known vulnerabilities so patches can be planned

pip list --outdated → Shows which installed packages have newer versions, helping track what is installed and what needs patching

Patches are tested in a separate environment before they are released to production → deploy(patch, "testing") if tests_pass: deploy(patch, "production")

Updates are scheduled at regular times to keep patching planned and predictable → schedule_patching("Tuesday", "02:00")

install_patch("production") # no testing done → The patch is installed straight onto production without being tested first, so it could break the software or cause downtime.

inventory = [] # patch only when someone remembers → There is no record of installed software and versions, so the team cannot know what needs patching and some vulnerable software will be missed.

Key Term

patch management

The regular, planned process of finding, testing and installing updates that fix known vulnerabilities in software, including libraries and frameworks.

Fill in the Blanks

1. pip list --outdated

Hint: Type the pip subcommand that shows the packages installed on a system.

2. pip install --upgrade requests

Hint: Type the flag word that tells pip to move a library to a newer, patched version.

3. IF result = "pass" THEN deploy(patch)

Hint: Type the function name that releases the patch once testing has succeeded.

4. IF today = patch_day THEN install_updates()

Hint: Type the variable that holds the planned day for updates, so patching follows a schedule.

5. npm audit

Hint: Type the npm command that checks installed libraries for known vulnerabilities.

Spot the Error

Question 1

A installed = '2.1'

B latest = '2.4'

C needs_patch = False

D if installed == latest:

E needs_patch = True

Line D — A library needs patching when the installed version is different from the latest version. The condition should use != so needs_patch becomes True when the versions differ.

Question 2

A patch = download('v1.2.1')

B apply(patch, test_server)

C passed = run_tests()

D if not passed:

E apply(patch, live_server)

Line D — A patch should only be released to the live server if the tests passed. The line should be if passed: so that failing patches are not released.

Question 3

A day = 'Tue'

B hour = 2

C if day = 'Tue' and hour < 5:

D install_updates()

Line C — The scheduled update window is checked with a comparison. Comparing needs == rather than =, which is assignment. It should be if day == 'Tue' and hour < 5:

Question 4

A libs = ['flask', 'numpy']

B for lib of libs:

C update(lib)

D run_tests()

Line B — Python loops use the keyword in, not of. The line should be for lib in libs: so every library in the list is patched.

Question 5

A inventory = {}

B inventory['flask'] == '2.3.1'

C inventory['numpy'] = '1.26'

D print(len(inventory))

Line B — Recording the installed version needs assignment with a single =. Using == only compares, so nothing is stored. It should be inventory['flask'] = '2.3.1'

Student with a class code? Join your class →