How do you approach patch management and system hardening?

Patch management balances security against stability, and needs a defined process rather than ad hoc updating.

• Maintain an inventory. You cannot patch what you do not know you have, and unknown systems are where breaches start.
• Categorise by risk. Critical and actively exploited vulnerabilities get an expedited path; routine updates follow the normal cycle.
• Test in rings. A pilot group, then a wider group, then production. This catches the patch that breaks a line-of-business application before it breaks everyone's.
• Schedule a maintenance window with communication and a rollback plan — including a snapshot or backup taken immediately before.
• Verify and report. Compliance reporting shows what remains unpatched and why.

Hardening reduces the attack surface:

• Remove what is not needed — unused services, default applications, and open ports. The most reliable security measure is absence.
• Change every default credential, and disable default accounts.
• Least privilege — users are not local administrators, and service accounts get only the rights they need.
• Enable host firewall and disk encryption, enforce secure protocols, and disable legacy ones such as SMBv1 and TLS 1.0.
• Centralise logging so evidence survives the compromise of the host.

Note: Cite a baseline standard such as CIS Benchmarks. Working to a published benchmark rather than personal preference is what makes hardening auditable.