Third-Party Patching (Chocolatey, Patch My PC, Munki)

#Your Adobe Reader Is More Vulnerable Than Your OS—Patch It.#link

Attackers increasingly target third-party apps—browsers, Java, PDF readers, and productivity suites—because they're patched less frequently than the OS. A 2022 Ponemon study found that 60% of breaches involved an unpatched vulnerability in a third-party application. This lesson explores the tools and strategies to bring third-party applications under the same automated patch governance as your OS.

Windows Third-Party Patching: Chocolatey and Patch My PC

Chocolatey is a package manager for Windows that can automate installation and updating of hundreds of popular applications via its community repository. For enterprise, Patch My PC integrates with Microsoft Intune or Configuration Manager to publish third-party updates as native update objects, with approval workflows and reporting. Both can keep browsers, runtimes, and plugins current. Use the 'choco upgrade all' command or scheduled tasks.

This simple command updates all apps managed by Chocolatey. Integrate it into your configuration management or run as a daily scheduled task.

macOS Third-Party Patching: Munki and AutoPkg

Munki is the de-facto macOS software management tool. It uses a manifest-based approach to install and update applications from a local repository. Combined with AutoPkg, you can automatically download the latest versions, import them into Munki, and test before deployment. This provides a true CI/CD pipeline for third-party app updates on macOS, ensuring apps like Zoom, Chrome, and VLC are always current.

# AutoPkg recipe run to download latest Firefox and import into Munki
autopkg run Firefox.munki
# This downloads, packages, and imports; then Munki clients see the update

Security Considerations for Third-Party Repositories

Using community repositories (Chocolatey community feed) introduces supply chain risk. Always validate checksums and use internal package repositories for high-security environments. For Chocolatey, use a private feed with approved packages. For Munki, scan imported packages with antivirus and maintain code signing verification. Never blindly trust public package sources for production.

• ▪Inventory all installed third-party applications across your fleet.
• ▪Deploy a third-party patching tool (Chocolatey, Munki, or Patch My PC) with an internal repository.
• ▪Create a daily/weekly automated update schedule; test on a subset first.
• ▪Scan all packages for malware and sign them before distribution.