Windows Security · Patch Tuesday & Vulnerabilities · Lesson 5 of 5

Challenge: The Office Patch Briefing

Brief a small dental office on this month's updates.

Monday at the dental office

You help out at a small dental office with six PCs. Five run Windows 11. The reception PC runs Windows 10 and is not enrolled in ESU.

It is the day after Patch Tuesday. Rosa, the office manager, asks for a five-minute briefing. You open the Security Update Guide and see this month's Windows fixes:

• About sixty fixes in all.
• Three marked Critical, with no known attacks yet.
• One marked Important, a privilege escalation in the Windows kernel, marked Exploitation Detected. It was also just added to CISA's KEV list.

You also read that Chrome fixed a zero-day last week. The office uses Chrome for its online lab orders.

Rosa is not a computer person, and that is fine. She wants plain answers: what matters most, how long it will take, and what to do about the old PC. Keep your answers short and true.

One update, every fix

Rosa looks worried. "Sixty fixes on six PCs? That sounds like a full day of work."

She pictures someone clicking through sixty separate installs on each machine, one after another.

You remind yourself how Windows actually delivers the monthly fixes. You also think about how you will prove to her afterward that each PC got them, since she will want to know the job is done. The five Windows 11 PCs are already set to install updates on their own.

The old reception PC

Next, Rosa asks about the reception PC. It runs the appointment software and the office email. It is too old for Windows 11. It got none of this month's Windows fixes, including the one attackers are using.

She says, "It still works fine, so can we just leave it?"

You think about what end of support means. The PC opens patient emails and attachments every day. Any new hole found in Windows 10 will stay open on it. A new PC is in next year's budget, but not this month's.

The one-line summary

Last, you look around the office. Several PCs show updates waiting. Chrome on the front desk has been open since last week, so its zero-day fix has downloaded but isn't running yet.

One staff member says she clicks "Remind me later" on the restart message every evening, because she doesn't want to lose her open windows.

Rosa asks for one simple instruction she can give the staff before lunch, covering both Windows and the browsers.