A patch management audit reveals that 15% of Windows workstations have not received the most recent security patches in 90 days. The primary reason is that these machines are used for 24/7 operations and cannot be rebooted. Which approach best balances security and operational continuity?
Select an answer to reveal the explanation.
Short Explanation
Here's the deal — you balance security and uptime by patching during low-activity windows, using live patching where available, and adding compensating controls for the highest-risk CVEs. You also document the exception with accepted risk approval, so governance is satisfied without breaking 24/7 operations.
Full Explanation
This approach combines scheduled low-impact patching during low-activity periods, live patching where available, compensating controls like network isolation, enhanced monitoring, and host firewall rules for the highest-risk CVEs, and documented exception with accepted risk approval. This meets both operational continuity and security governance requirements because it reduces exploitability of unpatched vulnerabilities while preserving 24/7 operations. Permanently exempting 24/7 systems from patching requirements is wrong because it creates an unmanaged risk that grows over time. Immediately force-rebooting all unpatched systems regardless of operational impact is wrong because forced reboots without planning may cause significant business disruption or data loss in 24/7 operations. Uninstalling the patch management agent from 24/7 systems to suppress audit findings is wrong because removing the patch agent suppresses visibility, worsens security posture, and is a compliance violation.