Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

3/3/2020
04:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Gotta Patch 'Em All? Not Necessarily, Experts Say

When it's impossible to remediate all vulnerabilities in an organization, data can indicate which bugs should be prioritized.

Modern security teams face a daunting task in keeping up with a growing amount of vulnerabilities. While they may not be able to patch all the flaws in their environments, they can cut down on risk by prioritizing high-risk vulnerabilities that are most likely to be exploited.

The volume of published common vulnerabilities and exposures (CVEs) has dramatically increased over the past 20 years, said Benjamin Edwards, senior data scientist with the Cyentia Institute, during the RSA Conference panel "Measuring Vulnerability Remediation Strategies with Real-World Data." Between 1999 and 2004, an average of 1,300 vulnerabilities were published per year. That number increased to 6,100 per year from 2005 to 2016 and then jumped to 18,000 per year for 2017 to 2020, he explained.

"Recently the number of vulnerabilities has increased quite a bit because we have expanded the number of people who can report and categorize CVEs," Edwards continued. Right now, there are more than 130,000 published vulnerabilities that can potentially affect organizations.

It's an overwhelming number denoting a common enterprise problem. Any given business, regardless of size, can patch one in 10 vulnerabilities each month, said Edwards. The data comes from "Prioritization to Prediction, Volume 4: Measuring What Matters in Remediation," a report recently published by the Cyentia Institute and Kenna Security based on a survey of about 100 organizations.

Forty percent of vulnerabilities in enterprise networks are still open today, researchers found. The median time to remediation is 100 days, and 25% of flaws remain open longer than a year. But, as Edwards pointed out, some vulnerabilities are more dangerous than others. There are flaws that affect millions of assets and those that affect hundreds, those that are easy to exploit and those that are difficult, he says. "Can you fix everything? Nope, not even close," Edwards said.

The next question becomes, "Can I remediate vulnerabilities before exploitation?" said Wade Baker, Cyentia Institute partner and co-founder. Chances are you won't patch vulnerabilities before they are weaponized, but you may be able to remediate them before an attacker uses them against you.

"About when a CVE is published, if it's exploited, it happens quickly," Baker continued, noting that zero-days and proof-of-concepts may happen before a flaw is disclosed. "The publication of a vulnerability is a trigger for exploitation, in many cases." Cyentia Institute researchers found 23% of vulnerabilities with published CVEs have associated exploit code.

Exploitation unfolds gradually. The timeline appears like a plateau in which activity initially spikes and then extends for nearly two-and-a-half years after the first exploit, he added. After about three years of activity, the likelihood of that vulnerability being exploited in the wild drops off.

What to Consider in A Remediation Program
The key to effective vulnerability management is knowing which flaws you should prioritize patching. You may not have the capacity to patch everything, but you do have the ability to learn which vulnerabilities are being exploited in the wild and which are in your environment. The research data shows one-third of published CVEs are observed in enterprise environments.

Remediation takes time. According to the research, 40% of vulnerabilities are remediated within the first month and half within the first two months. Nearly one-quarter of vulnerabilities are still open after a year.

The flaws to prioritize are those that have been both observed in enterprise environments and exploited in the wild, which applied to only 5% of all CVEs, researchers found. The "vast majority" (69%) of vulnerabilities never appear in a customer environment, Edwards said. More than half (54%) are never exploited in the wild or seen in enterprise environments. If attackers have not seen a flaw and nobody is using it, it's less of a concern to security teams.

Two in three organizations successfully remediate high-risk vulnerabilities, with 51% reducing the number of high-risk flaws in their environments and 17% maintaining the same level. Those paying down vulnerability debt are doing so with improved focus and execution, Baker said, pointing to four metrics firms can use to measure better or worse remediation performance:

  • Coverage: How comprehensive the remediation is; the percentage of exploited or high-risk flaws addressed.
  • Efficiency: How precise the remediation is; how many patched flaws are high-risk?
  • Velocity: The speed and progress of the remediation.
  • Capacity: Number of flaws that can be patched in a given timeframe and net gain/loss.

"There is statistically significant evidence that if you try to apply risk-based vulnerability management principles across large portions of your environment, you will fix vulnerabilities faster," Baker said. Researchers also found a simpler remediation process yielded better coverage, whereas more complex processes led to less coverage but slightly better velocity. Programs with adequate budgets fared better than those that lacked enough funds, he added.

The structure of vulnerability management programs made a difference. Time to remediate was about a month-and-a-half shorter among firms that place responsibilities for finding and fixing flaws in separate organizations. This separation of duties also led to higher capacity for remediation, meaning these businesses are less likely to fall behind. Researchers hypothesized having separate teams identify and remediate flaws indicates more resources and maturity.

Researchers also found 40% believed their vulnerability management programs were average, 36% considered them above average, 14% said they were below average, and 8% said they were in the top 10%. "People who think they're above average tend to be above average," Edwards said. "I was surprised at how well people knew their own programs."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "With New SOL4Ce Lab, Purdue U. and DoE Set Sights on National Security."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/6/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Why Cybersecurity's Silence Matters to Black Lives
Tiffany Ricks, CEO, HacWare,  7/8/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
The Threat from the Internetand What Your Organization Can Do About It
The Threat from the Internetand What Your Organization Can Do About It
This report describes some of the latest attacks and threats emanating from the Internet, as well as advice and tips on how your organization can mitigate those threats before they affect your business. Download it today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-15072
PUBLISHED: 2020-07-08
An issue was discovered in phpList through 3.5.4. An error-based SQL Injection vulnerability exists via the Import Administrators section.
CVE-2020-15073
PUBLISHED: 2020-07-08
An issue was discovered in phpList through 3.5.4. An XSS vulnerability occurs within the Import Administrators section via upload of an edited text document. This also affects the Subscriber Lists section.
CVE-2020-2034
PUBLISHED: 2020-07-08
An OS Command Injection vulnerability in the PAN-OS GlobalProtect portal allows an unauthenticated network based attacker to execute arbitrary OS commands with root privileges. An attacker requires some knowledge of the firewall to exploit this issue. This issue can not be exploited if GlobalProtect...
CVE-2019-19415
PUBLISHED: 2020-07-08
The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the specially crafted messages to the affected device. Due to the insufficient verification of the packets, successful exploit could allow the a...
CVE-2019-19416
PUBLISHED: 2020-07-08
The SIP module of some Huawei products have a denial of service (DoS) vulnerability. A remote attacker could exploit these three vulnerabilities by sending the specially crafted messages to the affected device. Due to the insufficient verification of the packets, successful exploit could allow the a...