Updates and the forgotten site

Software updates are security work. Many of them fix weaknesses that criminals already know about and are already using. CISA's basic advice to everyone fits in one line: update your software, and turn on automatic updates.

This lesson covers your own devices, the software past its support date, and the part most institutions miss: the website nobody remembers.

Your own devices

• Turn on automatic updates for your phone, your computer and your browser.
• Restart when asked. Many updates do nothing until the restart. Do it at the next break, the same day.
• Update apps too, not only the operating system. Browsers, PDF readers and office software are frequent targets.

If your institution manages updates centrally, your part is to restart when told and to report a device that keeps asking.

Software past its support date

Every product reaches an end-of-support date, after which the maker stops fixing security problems. Windows 10, for example, reached end of support on October 14, 2025. A computer still running it keeps working, but new holes stay open for good.

Look for these at your institution: the old computer that runs one program, the phone nobody replaced, the router from the last renovation, the camera system with its original software. Each needs a plan: update it, replace it, or disconnect it from the internet.

How to know what is urgent

CISA keeps a public list called the Known Exploited Vulnerabilities catalog. It names the weaknesses that have been exploited in the wild, and CISA tells organizations to use it to decide what to fix first.

You do not need to read it. Your IT contact or vendor should, and you can ask them: "Do we check the CISA catalog, and how fast do we act on it?"

The forgotten site

Many institutions have more websites than they think:

• the old site at old.yourtown.gov, kept "just in case,"
• the site for a festival, a grant program or a bond election years ago,
• a test copy a vendor made during the last redesign,
• a library, parks or volunteer site someone built on their own.

Nobody updates them, but they still run on your name. An outdated site can be broken into and used to host phishing pages or malware, and residents will see your institution's address on it.

Each site needs one of two things: an owner who keeps it updated, or a plan to take it down. Before taking anything down, check your records rules. Your clerk or records officer decides what must be kept and how.

Your main website

A website built on a content management system, such as WordPress or Drupal, has three layers to update: the core software, the plugins or modules, and the theme. Ask whoever runs it:

1. Who applies updates, and how often?
2. Is there a website firewall that blocks known attacks while an update is pending?
3. Which plugins or modules are installed but unused? Those should be removed.