Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

3/3/2020
04:30 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Gotta Patch 'Em All? Not Necessarily, Experts Say

When it's impossible to remediate all vulnerabilities in an organization, data can indicate which bugs should be prioritized.

Modern security teams face a daunting task in keeping up with a growing amount of vulnerabilities. While they may not be able to patch all the flaws in their environments, they can cut down on risk by prioritizing high-risk vulnerabilities that are most likely to be exploited.

The volume of published common vulnerabilities and exposures (CVEs) has dramatically increased over the past 20 years, said Benjamin Edwards, senior data scientist with the Cyentia Institute, during the RSA Conference panel "Measuring Vulnerability Remediation Strategies with Real-World Data." Between 1999 and 2004, an average of 1,300 vulnerabilities were published per year. That number increased to 6,100 per year from 2005 to 2016 and then jumped to 18,000 per year for 2017 to 2020, he explained.

"Recently the number of vulnerabilities has increased quite a bit because we have expanded the number of people who can report and categorize CVEs," Edwards continued. Right now, there are more than 130,000 published vulnerabilities that can potentially affect organizations.

It's an overwhelming number denoting a common enterprise problem. Any given business, regardless of size, can patch one in 10 vulnerabilities each month, said Edwards. The data comes from "Prioritization to Prediction, Volume 4: Measuring What Matters in Remediation," a report recently published by the Cyentia Institute and Kenna Security based on a survey of about 100 organizations.

Forty percent of vulnerabilities in enterprise networks are still open today, researchers found. The median time to remediation is 100 days, and 25% of flaws remain open longer than a year. But, as Edwards pointed out, some vulnerabilities are more dangerous than others. There are flaws that affect millions of assets and those that affect hundreds, those that are easy to exploit and those that are difficult, he says. "Can you fix everything? Nope, not even close," Edwards said.

The next question becomes, "Can I remediate vulnerabilities before exploitation?" said Wade Baker, Cyentia Institute partner and co-founder. Chances are you won't patch vulnerabilities before they are weaponized, but you may be able to remediate them before an attacker uses them against you.

"About when a CVE is published, if it's exploited, it happens quickly," Baker continued, noting that zero-days and proof-of-concepts may happen before a flaw is disclosed. "The publication of a vulnerability is a trigger for exploitation, in many cases." Cyentia Institute researchers found 23% of vulnerabilities with published CVEs have associated exploit code.

Exploitation unfolds gradually. The timeline appears like a plateau in which activity initially spikes and then extends for nearly two-and-a-half years after the first exploit, he added. After about three years of activity, the likelihood of that vulnerability being exploited in the wild drops off.

What to Consider in A Remediation Program
The key to effective vulnerability management is knowing which flaws you should prioritize patching. You may not have the capacity to patch everything, but you do have the ability to learn which vulnerabilities are being exploited in the wild and which are in your environment. The research data shows one-third of published CVEs are observed in enterprise environments.

Remediation takes time. According to the research, 40% of vulnerabilities are remediated within the first month and half within the first two months. Nearly one-quarter of vulnerabilities are still open after a year.

The flaws to prioritize are those that have been both observed in enterprise environments and exploited in the wild, which applied to only 5% of all CVEs, researchers found. The "vast majority" (69%) of vulnerabilities never appear in a customer environment, Edwards said. More than half (54%) are never exploited in the wild or seen in enterprise environments. If attackers have not seen a flaw and nobody is using it, it's less of a concern to security teams.

Two in three organizations successfully remediate high-risk vulnerabilities, with 51% reducing the number of high-risk flaws in their environments and 17% maintaining the same level. Those paying down vulnerability debt are doing so with improved focus and execution, Baker said, pointing to four metrics firms can use to measure better or worse remediation performance:

  • Coverage: How comprehensive the remediation is; the percentage of exploited or high-risk flaws addressed.
  • Efficiency: How precise the remediation is; how many patched flaws are high-risk?
  • Velocity: The speed and progress of the remediation.
  • Capacity: Number of flaws that can be patched in a given timeframe and net gain/loss.

"There is statistically significant evidence that if you try to apply risk-based vulnerability management principles across large portions of your environment, you will fix vulnerabilities faster," Baker said. Researchers also found a simpler remediation process yielded better coverage, whereas more complex processes led to less coverage but slightly better velocity. Programs with adequate budgets fared better than those that lacked enough funds, he added.

The structure of vulnerability management programs made a difference. Time to remediate was about a month-and-a-half shorter among firms that place responsibilities for finding and fixing flaws in separate organizations. This separation of duties also led to higher capacity for remediation, meaning these businesses are less likely to fall behind. Researchers hypothesized having separate teams identify and remediate flaws indicates more resources and maturity.

Researchers also found 40% believed their vulnerability management programs were average, 36% considered them above average, 14% said they were below average, and 8% said they were in the top 10%. "People who think they're above average tend to be above average," Edwards said. "I was surprised at how well people knew their own programs."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "With New SOL4Ce Lab, Purdue U. and DoE Set Sights on National Security."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
More SolarWinds Attack Details Emerge
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/12/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7343
PUBLISHED: 2021-01-18
Missing Authorization vulnerability in McAfee Agent (MA) for Windows prior to 5.7.1 allows local users to block McAfee product updates by manipulating a directory used by MA for temporary files. The product would continue to function with out-of-date detection files.
CVE-2020-28476
PUBLISHED: 2021-01-18
All versions of package tornado are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with default configura...
CVE-2020-28473
PUBLISHED: 2021-01-18
The package bottle from 0 and before 0.12.19 are vulnerable to Web Cache Poisoning by using a vector called parameter cloaking. When the attacker can separate query parameters using a semicolon (;), they can cause a difference in the interpretation of the request between the proxy (running with defa...
CVE-2021-25173
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory allocation with excessive size vulnerability exists when reading malformed DGN files, which allows attackers to cause a crash, potentially enabling denial of service (crash, exit, or restart).
CVE-2021-25174
PUBLISHED: 2021-01-18
An issue was discovered in Open Design Alliance Drawings SDK before 2021.12. A memory corruption vulnerability exists when reading malformed DGN files. It can allow attackers to cause a crash, potentially enabling denial of service (Crash, Exit, or Restart).