Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.


04:45 PM
Connect Directly

It Takes an Average 38 Days to Patch a Vulnerability

Analysis of 316 million-plus security incidents uncovers most common types of real-world attacks taking place within in-production Web apps in the AWS and Azure cloud ecosystems.

It takes over a month for the average organization to patch its most critical vulnerabilities, according to a new report detecting trends in Web application attacks.

The data comes from tCell, which today released its Q2 2018 "Security Report for In-Production Web Applications." Researchers analyzed more than 316 million security incidents across its customer base and published key findings on the most common types of real-world attacks taking place within in-production Web apps in the Amazon Web Services and Microsoft Azure cloud ecosystems.

TCell published the report for the first time last year, when it noted a high attack-to-breach ratio, explains co-founder and CEO Michael Feiertag. The volume of attempts that attackers go through before landing a successful breach are 100,000 to 1, he says. Web application attacks are noisy because attackers use automation to hunt weak spots within the apps.

"This year we evaluated the data over the last quarter to understand how access to security data from the application has impacted the team's ability to secure their apps," he continues. "We discovered that security teams who have this data gained measurable process improvements for remediation, used the data to improve collaboration with developer and operations peers, and helped prioritize work to gain scale for overstretched teams."

Researchers recognized two primary attacks at play. One was the prevalence of attempted cross-site scripting (XSS) attacks aimed at application users, which were the most common type of incident detected. Most instances of XSS are only attack attempts, they point out. Last year, only one in 1,200 attempts were successful, making it tough to separate breaches from attack attempts.

The second most common was SQL injection, which was leveraged to access sensitive data or run OS commands to gain further access into a target system. Automated threats, fire path traversal, and command injection rounded out the top five most common Web application attacks for Q2.

"We are seeing a bifurcation of attacks," Feiertag says. The majority, by volume, are scanning attacks in which probes target many apps with every possible easy-to-test attack. Researchers also saw a spike in targeted attacks, which hit individual apps with advanced threats going for high-value vulnerabilities: command injection to put malicious code on a server, for example, or compromised credentials to gain administrative access.

"Both appear to be financially motivated but with different approaches to achieve those goals – wide vs. deep," he adds.

TCell's top five most common incidents differ from the most popular attacks as listed by the Open Web Application Security Project (OWASP); those are injection flaws, broken authentication, sensitive data exposure, XML external entities, and broken access control. The reason is that tCell specifically considers attacks and breaches in production that reside in public cloud environments, while OWASP considers a broader set of data, which provides "a different view on the same problem," Feiertag explains.

CVEs: Prevalence and Patching
According to tCell's report, 90% of active applications had a known CVE, tCell says, while 30% had a critical CVE during the second quarter. Experts detected an average of 2,900 orphaned routes or exposed API endpoints per application, which signify an attack surface with no current business function and represent a security "blind spot," they explain in their report.

It took an average of 38 days for an organization to patch a vulnerability, regardless of its severity level, and 34 days for an organization to patch its most critical CVEs. Those stats may be affected by the size of the organization, researchers noted, given how larger businesses take significantly longer to patch vulnerabilities than smaller ones.

The less severe the vulnerability, the longer the time frame. Medium severity vulnerabilities took an average of 39 days to patch; low severity flaws took an average of 54 days. The oldest unpatched CVE took nearly a year – 340 days – to address.

Feiertag says the numbers have gotten better. "We've seen our customers significantly decrease their time to remediate rates," he notes, with teams becoming more aware of the need to roll out patches quickly.

Web App Security: What Companies Are Doing
Forward-looking companies are adopting application security approaches that integrate with DevOps and the cloud, Feiertag says. The technologies enabling this, such as RASP, are newer and still evolving but are an improvement over WAF, AST, and waterfall SDLC processes.

However, he continues, many teams and companies have not embraced this change and continue to fall behind, with their software and infrastructure getting ahead of their security tools and strategies.

"Ironically, those are frequently the companies that spend the most money on security, but the results that they achieve are generally below that of their more flexible and efficient peers," Feiertag says. He advises companies to understand their specific risks – "If you have an app on the Internet, it'll get attacked eventually," he says – and to use the right tools and data to minimize them.

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
8/24/2018 | 5:17:33 PM
I enjoyed reading the post
Interesting comment from one of the researchers, "Last year, only one in 1,200 attempts were successful, making it tough to separate breaches from attack attempts.". So last year, the money count was 9.7 Billion dollars, so 9,700,000,000/1200 = 8,083,333.33. So that means on average, they came out with 8M. I am not sure about you, but that is pretty extensive for someone not working or investing in the stock market.

"The second most common was SQL injection, which was leveraged to access sensitive data or run OS commands to gain further access into a target system. " - Maybe I missed something, I thought the first rule of thumb would be to install the database on a separate system other than the DB/Application sitting together, I think from that standpoint, isn't the person asking for trouble, just a rule of thumb.

"those are injection flaws, broken authentication, sensitive data exposure, XML external entities, and broken access control." - And isn't this just plain human error and no oversight on the part of the manager or director.

RASP - Run-Time Application Self Protection. This is interesting, they are developing this for the various phones but I don't see the development for servers or desktops. I do think machine learning is taking over in this space where the algorithms and teaching sequences are getting more complicated and the systems are learning. There was an incident where Facebook allowed two machines to learn from each other, they allowed the machine to communicate with each other and the systems started communicating with each other in a totally different language, the researchers were so frightened of the incident that they stopped the research project all together - https://goo.gl/2VcyRw. The last time I looked at Transformers, this occurred as well. All I can say is wow, we should have allowed them to communicate in a controlled environment to see what they would have come up with, they probably would have gone out of the electrical circuits to learn all the human behavior flaws, that would have been interesting.

"If you have an app on the Internet, it'll get attacked eventually," he says – and to use the right tools and data to minimize them." - I especially agree with this point, but at the end of the day, isn't security a facade, at the end of the day if we look into the imperceivable deep areas of the mind, where if put in the right circumstances, we would all break down and do the things that we said we would not (whether it would be money, fame, prestige or family concerns). I hope I never run down that path but who knows, only the future holds that truth.

Please keep the wonderful articles coming.


Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.