Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

3/8/2016
03:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Patch Management Still Plagues Enterprise

Half of organizations don't even know difference between applying a patch and remediating a vulnerability.

In spite of years of data showing effective patch management to be some of the lowest-hanging fruit in improving IT risk management, half of enterprises today still aren't getting it right. So says a new survey out today, which queried over 480 IT professionals on their patch management practices. 

“When we began this research, we expected patch fatigue to affect a small portion of the industry,” said Tyler Reguly, manager of Tripwire Vulnerability and Exposure Research Team (VERT), which conducted the survey with Dimensional Research. “Instead, we discovered that it is a broad, sweeping issue affecting a wide range of organizations.”

According to survey respondents, 50% believe that client-side patches are released at an unmanageable rate and the same percentage of IT teams don't understand the difference between applying a patch and remediating a vulnerability. 

"The fact is that we, as an industry, consistently conflate vulnerabilities with patches. They are not the same thing!" says Tim Erlin, director of IT risk and security strategist for Tripwire. "The fact is, we identify known vulnerabilities with CVE IDs, and vendors release increments of code that address some of those CVE IDs. It’s not a one-to-one relationship, except when it is, and bundles are common, except from vendors who don’t roll up patches. Sometimes patches don’t fix all the vulnerabilities, and sometimes they fix multiple vulnerabilities on some platforms but not others. Sometimes a patch is an upgrade, sometimes it’s not, and sometimes you can apply an individual patch or an upgrade to fix disparate but overlapping sets of vulnerabilities."

That jumble of factors played out in the survey, which showed that at least some of the time 67% of security teams have a difficult time understanding which patch needs to be applied to which system. That's made even more complicated by embedded products such as Adobe Flash patches released with Google Chrome updates--86% of respondents said this made it more difficult to understand the impact of a patch.

"The confusion between remediating vulnerabilities and applying patches is one example of the complexity surrounding enterprise patch management," Erlin says. "We haven’t touched on the technical challenges of distribution, auditing performance, or organizational silos. When we look at the steady stream of patches that vendors push, with multiple strategies, it’s no wonder that we see gaps."

These findings are bolstered by those of another less formal survey released last week by Bromium, which asked 100 RSA Conference attendees about their security practices and attitudes. In it, 49% reported that the endpoint is the source of their greatest security risk, ahead of insider threat, network insecurity and cloud risks. The survey showed that only half of organizations are able to implement patches for zero-day vulnerabilities within a week of release. 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AdmnStudio
50%
50%
AdmnStudio,
User Rank: Apprentice
5/5/2016 | 10:33:43 AM
Software Vulnerabilities

It is no suprise that "49% reported that the endpoint is the source of their greatest security risk...", with the proliferation on devices and wearables, an endpoint can be anything and any where. Each one is an entry point into a complex enterprise environment.

It is shocking that "50% believe that client-side patches are released at an unmanageable rate" and "... only half of organizations are able to implement patches for zero-day vulnerabilities within a week of release. "

When fighting Cyber Crime, software publisher need to relase patches as soon as a vulnerability is identified, speed is important to address know exploits.  If this is too fast for an IT team to respond, they don't have the right automation and SAM tools. When a known critical software vulnerability is published, IT should be informed of which endpoints are impacted and automate the deployment of patches.

Hackers are way ahead of enterprises in being quick and agile.

 

CamiloD
50%
50%
CamiloD,
User Rank: Apprentice
3/9/2016 | 3:13:55 PM
Still a long away ahead
Great article! It showcases one of the most talked-about issues in maintaining a strong security posture. And as the article mentions, vulnerabilities are much larger than patches - Social engineering, trivial physical access, and faulty business processes are some examples that show that, actually, few vulnerabilities are remediated solely by patch management.
AI Is Everywhere, but Don't Ignore the Basics
Howie Xu, Vice President of AI and Machine Learning at Zscaler,  9/10/2019
Fed Kaspersky Ban Made Permanent by New Rules
Dark Reading Staff 9/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
The State of IT Operations and Cybersecurity Operations
The State of IT Operations and Cybersecurity Operations
Your enterprise's cyber risk may depend upon the relationship between the IT team and the security team. Heres some insight on what's working and what isn't in the data center.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-4147
PUBLISHED: 2019-09-16
IBM Sterling File Gateway 2.2.0.0 through 6.0.1.0 is vulnerable to SQL injection. A remote attacker could send specially-crafted SQL statements, which could allow the attacker to view, add, modify or delete information in the back-end database. IBM X-Force ID: 158413.
CVE-2019-5481
PUBLISHED: 2019-09-16
Double-free vulnerability in the FTP-kerberos code in cURL 7.52.0 to 7.65.3.
CVE-2019-5482
PUBLISHED: 2019-09-16
Heap buffer overflow in the TFTP protocol handler in cURL 7.19.4 to 7.65.3.
CVE-2019-15741
PUBLISHED: 2019-09-16
An issue was discovered in GitLab Omnibus 7.4 through 12.2.1. An unsafe interaction with logrotate could result in a privilege escalation
CVE-2019-16370
PUBLISHED: 2019-09-16
The PGP signing plugin in Gradle before 6.0 relies on the SHA-1 algorithm, which might allow an attacker to replace an artifact with a different one that has the same SHA-1 message digest, a related issue to CVE-2005-4900.