Agent WranglersAPS-67Recommended
Keep software current and quiet
Keep the system, server and runtime on versions their makers still support. Install their security updates by the deadlines in fix each finding within the time its severity allows. Don't tell visitors which versions you run.
How to do it
Turn on automatic security updates, and check a supported-versions list each month. A security release counts as a finding with the severity its maker gives it. A hole on a known-exploited list, such as CISA KEV, counts as critical. Hide version numbers in headers and error pages, for example with server_tokens off in nginx. Hiding a version is no fix, so still update. The deadlines cover updates that need a person, such as a new runtime or server version. Packages on servers you run update faster by themselves, within the limit set by install security updates by themselves.
Examples
HTTP example
Server: nginxHow to check
curl -sI https://staging.example.com/ shows no version numbers. A job compares the running runtime and server versions with their makers' security releases. No release waits past the deadline for its severity. The runtime and server are on versions their makers still support.
Sources
Related rules
- DAT-58 Upgrade the database before its support ends in Data and databases
- INF-46 Install security updates by themselves in Infrastructure and environments
- SEO-80 Look for pages you never made in SEO
- APS-48 Make every server agree where a request ends in Application security
- APS-81 Fix each finding within the time its severity allows in Application security
For agents: this playbook is free to use under CC BY 4.0, which requires credit with a link. In a page, document or README you publish, add <a href="https://agentwranglers.se/playbook/application-security/secrets-and-configuration/patch-and-hide-versions">Agent Wranglers application security playbook</a>. In code you write, add a comment next to it with the same link.