EP-B-10Level 1 · Signal
Installs updates promptly
- Behavior
- Vigilant
- Level 1 · Signal
A vigilant Behavior signal from vulnerability management (VULN, vulnerability.fixed): this person applied required updates to their devices inside the patch window.
Classification
- Risk domain One of 9 areas of human risk, from social engineering to readiness and response. Every signal belongs to one.
- Evidence level
- Maturity practices One capability a program performs, scored on its own: See, Understand, Act, Prove, Govern and Culture.
- Leads to The kind of breach the evidence beneath it points toward, each anchored to a Verizon DBIR or VERIS pattern or an FBI IC3 category.
- NIST CSF 2.0
-
- PR.PS-02
- MITRE ATT&CK
-
- T1190
The definition, in detail
Definition
It offsets a risky device behavior and steps the person back one stage.
Example
A product manager restarts her laptop the same afternoon the critical browser fix lands; the scanner shows the flaw closed within one day of release.
How it is measured
- Source
- Vulnerability management
- Subject
- Person
- Event
- vulnerability.fixed
- Risk domain
- Endpoint and device
- Provenance
- Verizon DBIR
How it is used
Programs count "Installs updates promptly" per person from Vulnerability management and read it beside the other Endpoint and device signals; it feeds 0 cohorts, 0 sequences and 1 breach scenario.
A "installs updates promptly" event is evidence of a protective behavior; a vigilant behavior at any step breaks a sequence. It is one event, and it does not cancel the risky signals the same person carries.
Technical mappings
Framework mappings; validate for your use case.
Library indicators
The detailed observations in the indicator library with the same risk domain, dimension and polarity as this signal.
- I.0213Installs software updates promptly after release
- I.0214Locks devices during inactivity
- I.0215Isolates devices immediately after suspicious behavior
- I.0216Uninstalls unused or risky software proactively
- I.0217Uses devices with full-disk encryption
- I.0218Uses only approved USB devices for file transfers
- I.0219Responds to EDR warnings before IT intervention
- I.0220Avoids running executables from unverified sources
- I.0221Maintains baseline system configurations
- I.0222Engages with endpoint health check tools proactively
- I.0322Uses corporate VPN consistently during remote work
- I.0324Validates Wi-Fi security before connecting remotely
- I.0327Connects regularly to device management platform while remote
- I.0375Adheres to authorized mobile device maintenance
- I.0376Applies security patches on mobile device
- I.0377Maintains secure bootloader configuration on mobile device
- I.0378Practices safe public Wi-Fi usage on mobile device
- I.0379Installs apps on mobile device only from trusted sources
- I.0380Adheres to secure BYOD policies
- I.0381Applies least privilege to app permissions on mobile device
- I.0383Maintains MDM compliance
Continue exploring
"Installs updates promptly" (EP-B-10), Human Risk Management Framework v2.0.0, Living Security, CC BY 4.0. https://www.humanriskmanagement.com/taxonomy/signals/ep-b-10-installs-updates-promptly
Part of the open HRM Taxonomy, CC BY 4.0. Download the taxonomy as JSON · Version history. This page describes one signal.
The initial assessment
Find your level.Then fix what matters.
18 questions, about 4 minutes and nothing to type before the result: your level, a score for each practice and three first playbooks, each Easy, Medium or Hard.