Endpoint

3/8/2016
03:30 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Patch Management Still Plagues Enterprise

Half of organizations don't even know difference between applying a patch and remediating a vulnerability.

In spite of years of data showing effective patch management to be some of the lowest-hanging fruit in improving IT risk management, half of enterprises today still aren't getting it right. So says a new survey out today, which queried over 480 IT professionals on their patch management practices. 

“When we began this research, we expected patch fatigue to affect a small portion of the industry,” said Tyler Reguly, manager of Tripwire Vulnerability and Exposure Research Team (VERT), which conducted the survey with Dimensional Research. “Instead, we discovered that it is a broad, sweeping issue affecting a wide range of organizations.”

According to survey respondents, 50% believe that client-side patches are released at an unmanageable rate and the same percentage of IT teams don't understand the difference between applying a patch and remediating a vulnerability. 

"The fact is that we, as an industry, consistently conflate vulnerabilities with patches. They are not the same thing!" says Tim Erlin, director of IT risk and security strategist for Tripwire. "The fact is, we identify known vulnerabilities with CVE IDs, and vendors release increments of code that address some of those CVE IDs. It’s not a one-to-one relationship, except when it is, and bundles are common, except from vendors who don’t roll up patches. Sometimes patches don’t fix all the vulnerabilities, and sometimes they fix multiple vulnerabilities on some platforms but not others. Sometimes a patch is an upgrade, sometimes it’s not, and sometimes you can apply an individual patch or an upgrade to fix disparate but overlapping sets of vulnerabilities."

That jumble of factors played out in the survey, which showed that at least some of the time 67% of security teams have a difficult time understanding which patch needs to be applied to which system. That's made even more complicated by embedded products such as Adobe Flash patches released with Google Chrome updates--86% of respondents said this made it more difficult to understand the impact of a patch.

"The confusion between remediating vulnerabilities and applying patches is one example of the complexity surrounding enterprise patch management," Erlin says. "We haven’t touched on the technical challenges of distribution, auditing performance, or organizational silos. When we look at the steady stream of patches that vendors push, with multiple strategies, it’s no wonder that we see gaps."

These findings are bolstered by those of another less formal survey released last week by Bromium, which asked 100 RSA Conference attendees about their security practices and attitudes. In it, 49% reported that the endpoint is the source of their greatest security risk, ahead of insider threat, network insecurity and cloud risks. The survey showed that only half of organizations are able to implement patches for zero-day vulnerabilities within a week of release. 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AdmnStudio
50%
50%
AdmnStudio,
User Rank: Apprentice
5/5/2016 | 10:33:43 AM
Software Vulnerabilities

It is no suprise that "49% reported that the endpoint is the source of their greatest security risk...", with the proliferation on devices and wearables, an endpoint can be anything and any where. Each one is an entry point into a complex enterprise environment.

It is shocking that "50% believe that client-side patches are released at an unmanageable rate" and "... only half of organizations are able to implement patches for zero-day vulnerabilities within a week of release. "

When fighting Cyber Crime, software publisher need to relase patches as soon as a vulnerability is identified, speed is important to address know exploits.  If this is too fast for an IT team to respond, they don't have the right automation and SAM tools. When a known critical software vulnerability is published, IT should be informed of which endpoints are impacted and automate the deployment of patches.

Hackers are way ahead of enterprises in being quick and agile.

 

CamiloD
50%
50%
CamiloD,
User Rank: Apprentice
3/9/2016 | 3:13:55 PM
Still a long away ahead
Great article! It showcases one of the most talked-about issues in maintaining a strong security posture. And as the article mentions, vulnerabilities are much larger than patches - Social engineering, trivial physical access, and faulty business processes are some examples that show that, actually, few vulnerabilities are remediated solely by patch management.
6 Ways Greed Has a Negative Effect on Cybersecurity
Joshua Goldfarb, Co-founder & Chief Product Officer, IDRRA ,  6/11/2018
Weaponizing IPv6 to Bypass IPv4 Security
John Anderson, Principal Security Consultant, Trustwave Spiderlabs,  6/12/2018
'Shift Left' & the Connected Car
Rohit Sethi, COO of Security Compass,  6/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-12026
PUBLISHED: 2018-06-17
During the spawning of a malicious Passenger-managed application, SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows such applications to replace key files or directories in the spawning communication directory with symlinks. This then could result in arbitrary reads and writes, which in tur...
CVE-2018-12027
PUBLISHED: 2018-06-17
An Insecure Permissions vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 causes information disclosure in the following situation: given a Passenger-spawned application process that reports that it listens on a certain Unix domain socket, if any of the parent directories of said ...
CVE-2018-12028
PUBLISHED: 2018-06-17
An Incorrect Access Control vulnerability in SpawningKit in Phusion Passenger 5.3.x before 5.3.2 allows a Passenger-managed malicious application, upon spawning a child process, to report an arbitrary different PID back to Passenger's process manager. If the malicious application then generates an e...
CVE-2018-12029
PUBLISHED: 2018-06-17
A race condition in the nginx module in Phusion Passenger 3.x through 5.x before 5.3.2 allows local escalation of privileges when a non-standard passenger_instance_registry_dir with insufficiently strict permissions is configured. Replacing a file with a symlink after the file was created, but befor...
CVE-2018-12071
PUBLISHED: 2018-06-17
A Session Fixation issue exists in CodeIgniter before 3.1.9 because session.use_strict_mode in the Session Library was mishandled.