Endpoint
3/8/2016
03:30 PM
Connect Directly
Twitter
Twitter
RSS
E-Mail
50%
50%

Patch Management Still Plagues Enterprise

Half of organizations don't even know difference between applying a patch and remediating a vulnerability.

In spite of years of data showing effective patch management to be some of the lowest-hanging fruit in improving IT risk management, half of enterprises today still aren't getting it right. So says a new survey out today, which queried over 480 IT professionals on their patch management practices. 

“When we began this research, we expected patch fatigue to affect a small portion of the industry,” said Tyler Reguly, manager of Tripwire Vulnerability and Exposure Research Team (VERT), which conducted the survey with Dimensional Research. “Instead, we discovered that it is a broad, sweeping issue affecting a wide range of organizations.”

According to survey respondents, 50% believe that client-side patches are released at an unmanageable rate and the same percentage of IT teams don't understand the difference between applying a patch and remediating a vulnerability. 

"The fact is that we, as an industry, consistently conflate vulnerabilities with patches. They are not the same thing!" says Tim Erlin, director of IT risk and security strategist for Tripwire. "The fact is, we identify known vulnerabilities with CVE IDs, and vendors release increments of code that address some of those CVE IDs. It’s not a one-to-one relationship, except when it is, and bundles are common, except from vendors who don’t roll up patches. Sometimes patches don’t fix all the vulnerabilities, and sometimes they fix multiple vulnerabilities on some platforms but not others. Sometimes a patch is an upgrade, sometimes it’s not, and sometimes you can apply an individual patch or an upgrade to fix disparate but overlapping sets of vulnerabilities."

That jumble of factors played out in the survey, which showed that at least some of the time 67% of security teams have a difficult time understanding which patch needs to be applied to which system. That's made even more complicated by embedded products such as Adobe Flash patches released with Google Chrome updates--86% of respondents said this made it more difficult to understand the impact of a patch.

"The confusion between remediating vulnerabilities and applying patches is one example of the complexity surrounding enterprise patch management," Erlin says. "We haven’t touched on the technical challenges of distribution, auditing performance, or organizational silos. When we look at the steady stream of patches that vendors push, with multiple strategies, it’s no wonder that we see gaps."

These findings are bolstered by those of another less formal survey released last week by Bromium, which asked 100 RSA Conference attendees about their security practices and attitudes. In it, 49% reported that the endpoint is the source of their greatest security risk, ahead of insider threat, network insecurity and cloud risks. The survey showed that only half of organizations are able to implement patches for zero-day vulnerabilities within a week of release. 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AdmnStudio
50%
50%
AdmnStudio,
User Rank: Apprentice
5/5/2016 | 10:33:43 AM
Software Vulnerabilities

It is no suprise that "49% reported that the endpoint is the source of their greatest security risk...", with the proliferation on devices and wearables, an endpoint can be anything and any where. Each one is an entry point into a complex enterprise environment.

It is shocking that "50% believe that client-side patches are released at an unmanageable rate" and "... only half of organizations are able to implement patches for zero-day vulnerabilities within a week of release. "

When fighting Cyber Crime, software publisher need to relase patches as soon as a vulnerability is identified, speed is important to address know exploits.  If this is too fast for an IT team to respond, they don't have the right automation and SAM tools. When a known critical software vulnerability is published, IT should be informed of which endpoints are impacted and automate the deployment of patches.

Hackers are way ahead of enterprises in being quick and agile.

 

CamiloD
50%
50%
CamiloD,
User Rank: Apprentice
3/9/2016 | 3:13:55 PM
Still a long away ahead
Great article! It showcases one of the most talked-about issues in maintaining a strong security posture. And as the article mentions, vulnerabilities are much larger than patches - Social engineering, trivial physical access, and faulty business processes are some examples that show that, actually, few vulnerabilities are remediated solely by patch management.
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
DNS Threats: What Every Enterprise Should Know
Domain Name System exploits could put your data at risk. Here's some advice on how to avoid them.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
Tim Wilson speaks to two experts on vulnerability research – independent consultant Jeremiah Grossman and Black Duck Software’s Mike Pittenger – about the latest wave of vulnerabilities being exploited by online attackers