Updates and outdated software

Module 5: Devices, software and network · Reading time: 10 minutes

Learning objective: After this lesson, you can set up an update policy for operating systems, apps, plugins, routers and other devices, and explain what "end of life" means and what to do about it.
Key concepts: vulnerability, patch, zero-day, automatic updates, firmware, plugin, inventory, end of life, edge device

An update is a lock you add afterwards

Software contains flaws. Some flaws are merely annoying (a button that doesn't work), others are a vulnerability: a flaw that lets an attacker do something they shouldn't, such as logging in without a password or running their own code. The maker fixes this with a patch, which reaches you as an update.

The tricky part is the order of events. As soon as an update is released, the vulnerability is effectively public. Attackers compare the old and new versions, see what was fixed, and build an attack based on that. They then automatically scan the whole internet for devices that haven't installed the update yet. That's exactly the opportunistic attack from lesson 1.1: they're not looking for you specifically, they're looking for anyone who's behind.

A zero-day is a vulnerability that's already being exploited before a patch exists. There's little you can do about this except follow the maker's advice and limit the damage (backups, minimal permissions). But the vast majority of break-ins at small businesses happen through vulnerabilities for which the update had long been available.

The former Digital Trust Center, now part of the NCSC, found in its 2024 Cyberveilig Check that more than one in three small businesses (36%) didn't have automatic updates turned on for all their internet-connected devices. The advice from the NCSC is simple: don't wait to update, and turn on automatic updates wherever you can.

What do you actually have? The inventory

You can't update what you've forgotten about. Most businesses think of laptops and phones when it comes to updates, but the most dangerous devices are often the quiet ones:

Type	Examples	How it usually updates
Computers and phones	Windows, macOS, Linux, Android, iOS	Automatically, if you turn it on and don't endlessly postpone the restart
Programs and apps	Browser, office suite, PDF reader, accounting app	Often automatic; standalone programs sometimes not
Website	CMS, plugins, themes, PHP version	Partly automatic; plugins and themes often manual
Network equipment	Router, modem, wifi access points, firewall, VPN server	Firmware, often manual or via the provider
Edge devices	NAS, network printer, IP camera, smart doorbell, alarm system, point-of-sale system	Firmware, often manual, sometimes never
Cloud services	Email, accounting, webshop platform	The supplier updates it; you manage the settings

Devices that connect directly to the internet and are reachable from outside (router, VPN server, NAS with remote access, camera) are called edge devices. These are the most common target, because an attacker can reach them without any employee needing to click anything. An anonymised example: an accountancy firm had a NAS with "access from anywhere" turned on. The maker released a security update, the firm didn't install it, and a few weeks later all the files on the NAS were encrypted. Nobody had clicked on anything.

An update policy in five agreements

A policy doesn't need to be a ten-page document. For a small business, these agreements work:

Automatic wherever possible. Turn on automatic updates for operating systems, browsers, apps, and where possible for your CMS and plugins and for the firmware of your router and NAS.
Restarting is part of it. Many updates only take effect after a restart. Agree that everyone restarts at least once a week, and don't postpone a restart for weeks.
Edge devices first. For devices reachable from outside: check yourself whether updates are available, for example once a month, and install a security update within a few days. If the maker or the NCSC warns of active exploitation, do it the same day.
One owner per device. Your inventory should list, per line, who updates it: you, a colleague, your IT company or your web developer. If nobody is listed, nobody does it.
What's no longer needed goes. A plugin you don't use, an old laptop in the cupboard that still connects to the network, a test site on a subdomain: remove it, then you don't need to update it either.

Not sure whether an update might break something? Make a backup first (module 6) and then update. Not installing an update out of fear of problems is almost always the bigger risk.

End of life: when updates stop coming

Every version of software or firmware has an end date. After that, the maker stops releasing security updates. This is called end of life (EOL). The device still works, and that's exactly what makes it treacherous: nobody notices anything, while every new vulnerability stays open forever.

Examples:

Windows 10. Regular support ended on 14 October 2025. After that, security updates are only available through Microsoft's ESU programme, with end dates that vary by situation. Check Microsoft's website to see what applies to your devices, and plan your move to a supported version or a different device.
PHP and other website languages. Each PHP version gets a few years of security updates. If your website runs on an old version, the server might be secure, but your site isn't.
Routers, NAS and cameras. Cheap devices sometimes get only a few years of firmware updates, sometimes none at all. The NCSC recommends finding out before you buy how long the maker will support the device, and replacing devices that no longer receive updates.
Plugins and themes. A plugin whose maker has stopped developing it won't get any more fixes. Look for a replacement.

Can't replace something straight away? Limit the risk: take it off the internet, put it on a separate network (lesson 5.3), and don't give it access to important data.

Updating safely: only through official channels

Attackers also misuse the word "update". A pop-up on a website saying "Your browser is out of date, download the update here" or an email saying "install the security update in the attachment" is almost always malware. Genuine updates come through the operating system, the app store, the update function within the program itself, or the maker's website. Never through a link in an email or a pop-up on a random site.

In practice: what it looks like

With a hosting package using DirectAdmin, such as with WebOké, you choose your site's PHP version via Select PHP version. If you want to make a backup before updating your website or plugins, you can do this in Installatron with the Backup button, after which you can restore the previous version if something goes wrong. With other providers it works similarly: look for "PHP version" and for your CMS's backup or staging feature.

For computers and phones, the update function is in the operating system's settings. For your router, check the admin page (the address is in the manual or on the router's sticker) or your provider's app.

Summary

An update closes a known vulnerability; once it's released, attackers scan the internet for whoever is behind.
Make an inventory, including your router, NAS, printer, cameras, website and plugins, with an owner per line.
Update automatically wherever possible, restarting is part of it, edge devices first and fast.
End of life means: no more security updates. Replace it, or disconnect and isolate it.
Updates only through official channels, never through a pop-up or email.

Quiz

Exercise

Exercise D5.1: Your update inventory. Make a list of all your devices and software, including router, NAS, printer, cameras, website and plugins. For each line, note the version, whether automatic updates are turned on, who the owner is, and whether it's still supported. Update anything that's behind and answer the reflection questions.

Cookies at WebOké

Cookie settings

Necessary

Marketing