Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Endpoint

3/8/2016
03:30 PM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

Patch Management Still Plagues Enterprise

Half of organizations don't even know difference between applying a patch and remediating a vulnerability.

In spite of years of data showing effective patch management to be some of the lowest-hanging fruit in improving IT risk management, half of enterprises today still aren't getting it right. So says a new survey out today, which queried over 480 IT professionals on their patch management practices. 

“When we began this research, we expected patch fatigue to affect a small portion of the industry,” said Tyler Reguly, manager of Tripwire Vulnerability and Exposure Research Team (VERT), which conducted the survey with Dimensional Research. “Instead, we discovered that it is a broad, sweeping issue affecting a wide range of organizations.”

According to survey respondents, 50% believe that client-side patches are released at an unmanageable rate and the same percentage of IT teams don't understand the difference between applying a patch and remediating a vulnerability. 

"The fact is that we, as an industry, consistently conflate vulnerabilities with patches. They are not the same thing!" says Tim Erlin, director of IT risk and security strategist for Tripwire. "The fact is, we identify known vulnerabilities with CVE IDs, and vendors release increments of code that address some of those CVE IDs. It’s not a one-to-one relationship, except when it is, and bundles are common, except from vendors who don’t roll up patches. Sometimes patches don’t fix all the vulnerabilities, and sometimes they fix multiple vulnerabilities on some platforms but not others. Sometimes a patch is an upgrade, sometimes it’s not, and sometimes you can apply an individual patch or an upgrade to fix disparate but overlapping sets of vulnerabilities."

That jumble of factors played out in the survey, which showed that at least some of the time 67% of security teams have a difficult time understanding which patch needs to be applied to which system. That's made even more complicated by embedded products such as Adobe Flash patches released with Google Chrome updates--86% of respondents said this made it more difficult to understand the impact of a patch.

"The confusion between remediating vulnerabilities and applying patches is one example of the complexity surrounding enterprise patch management," Erlin says. "We haven’t touched on the technical challenges of distribution, auditing performance, or organizational silos. When we look at the steady stream of patches that vendors push, with multiple strategies, it’s no wonder that we see gaps."

These findings are bolstered by those of another less formal survey released last week by Bromium, which asked 100 RSA Conference attendees about their security practices and attitudes. In it, 49% reported that the endpoint is the source of their greatest security risk, ahead of insider threat, network insecurity and cloud risks. The survey showed that only half of organizations are able to implement patches for zero-day vulnerabilities within a week of release. 

 

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
AdmnStudio
50%
50%
AdmnStudio,
User Rank: Apprentice
5/5/2016 | 10:33:43 AM
Software Vulnerabilities

It is no suprise that "49% reported that the endpoint is the source of their greatest security risk...", with the proliferation on devices and wearables, an endpoint can be anything and any where. Each one is an entry point into a complex enterprise environment.

It is shocking that "50% believe that client-side patches are released at an unmanageable rate" and "... only half of organizations are able to implement patches for zero-day vulnerabilities within a week of release. "

When fighting Cyber Crime, software publisher need to relase patches as soon as a vulnerability is identified, speed is important to address know exploits.  If this is too fast for an IT team to respond, they don't have the right automation and SAM tools. When a known critical software vulnerability is published, IT should be informed of which endpoints are impacted and automate the deployment of patches.

Hackers are way ahead of enterprises in being quick and agile.

 

CamiloD
50%
50%
CamiloD,
User Rank: Apprentice
3/9/2016 | 3:13:55 PM
Still a long away ahead
Great article! It showcases one of the most talked-about issues in maintaining a strong security posture. And as the article mentions, vulnerabilities are much larger than patches - Social engineering, trivial physical access, and faulty business processes are some examples that show that, actually, few vulnerabilities are remediated solely by patch management.
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Ripple20 Threatens Increasingly Connected Medical Devices
Kelly Sheridan, Staff Editor, Dark Reading,  6/30/2020
DDoS Attacks Jump 542% from Q4 2019 to Q1 2020
Dark Reading Staff 6/30/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15505
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1, and Sentry before 9.7.3 and 9.8.x before 9.8.1, allow remote attackers to execute arbitrary code via unspecified vectors.
CVE-2020-15506
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1 allow remote attackers to bypass authentication mechanisms via unspecified vectors.
CVE-2020-15507
PUBLISHED: 2020-07-07
MobileIron Core and Connector before 10.3.0.4, 10.4.x before 10.4.0.4, 10.5.x before 10.5.1.1, 10.5.2.x before 10.5.2.1, and 10.6.x before 10.6.0.1 allow remote attackers to read files on the system via unspecified vectors.
CVE-2020-15096
PUBLISHED: 2020-07-07
In Electron before versions 6.1.1, 7.2.4, 8.2.4, and 9.0.0-beta21, there is a context isolation bypass, meaning that code running in the main world context in the renderer can reach into the isolated Electron context and perform privileged actions. Apps using "contextIsolation" are affecte...
CVE-2020-4075
PUBLISHED: 2020-07-07
In Electron before versions 7.2.4, 8.2.4, and 9.0.0-beta21, arbitrary local file read is possible by defining unsafe window options on a child window opened via window.open. As a workaround, ensure you are calling `event.preventDefault()` on all new-window events where the `url` or `options` is not ...