Development of a framework for secure patch management

With the growing expansion of Internet connectivity and usage by consumers and merchants, financial institutions and governmental entities, the requirement for stable and secure software is being elevated to the legislative and judicial levels. No longer can software manufacturers disregard this growing requirement in fulfilling their commercial obligations. The issuance of a patch is the beginning and not the end of a software developer’s obligations to its customers and all subsequent parties impacted by its product. In this paper, the authors provide a framework detailing the components of a secure patch management system, a discussion on the necessity of managing and securing each phase/component, and some basic patch issuance concerns with regards to the supporting legal environment.