Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

05:40 PM
Connect Directly

Missing Patches, Misconfiguration Top Technical Breach Causes

Less than half of businesses surveyed can patch critical vulnerabilities within 72 hours. Why does the process take so long?

Nearly 60% of data breaches in the past two years can be traced back to a missing operating system patch or application patch, researchers report. Poor patch management can be linked to the high costs of downtime and disruption, both of which are magnified in larger organizations and are poised to escalate as businesses rush to support fully remote staff as COVID-19 spreads.

The stat comes from Automox, where a team polled 560 IT and security pros at companies with 500 to 25,000 employees. They learned 81% had suffered a breach in the past two years. Thirty-six percent of those incidents stemmed from a phishing attack, which was the most common root cause, followed by missing OS patch (30%), missing application patch (28%), OS misconfiguration (27%), insider threat (26%), credential theft (22%), and brute force (17%).

"Everyone is aware that phishing attacks are a top root cause for data breaches," says Jay Goodman, strategic product marketing manager with Automox. "What we found is there is a surprising amount [of] OS patches, application patches, and misconfiguration mistakes that led to root the cause for data breaches."

This data indicates improved patching processes could strengthen enterprise defense against cybercrime; however, patch management has historically been a nightmare for IT and security teams: 12,174 common vulnerabilities and exposures (CVEs) were reported last year, and applying these patches takes time. Less than half of businesses Automox surveyed would be able to patch critical vulnerabilities within 72 hours of their disclosure, and only 20% could patch zero-day flaws within a 24-hour period.

"It's a scale issue and it's a prioritization issue," says Stephen Boyer, co-founder and CTO at BitSight. "Think about all the vulnerabilities coming at you. The key question is which vulnerabilities [to patch] and when."

Patching is pricey, and larger businesses suffer greater losses in disruption and downtime. Boyer refers to a defense contractor as an example: There, he says, it could cost $250,000 to roll out a single patch. Not all fixes are this expensive, but let's say the average hourly wage for a company is $25 per hour, and updating a system disrupts work for 10 minutes per employee. With an employee base of 50,000 people, that amounts to about $208,000 in lost productivity.

"Of course, not all patches will cause this much disruption, but you can see how it can add up," he explains. Patching requires IT and security to juggle complexity, scale, and prioritization. "It's a very, very difficult problem in practice," Boyer notes, and it's not a trivial task for security teams to handle when tens of thousands of vulnerabilities are being disclosed each year.

"It's easier for small businesses because they don't have the overhead of the processes associated with patching that larger organizations have to implement," says Goodman. Security teams need to verify a patch works, make sure it doesn't interfere with other systems, and slowly roll it out to a small subset of users to ensure it's working as it should be.

Larger organizations are also at a disadvantage because they're more likely to run older OS versions. When Microsoft ended support for Windows 7 in January, nearly 90% of firms with more than 10,000 employees were still running it on at least one machine. Only 61% of businesses with fewer than 1,000 employees were doing the same, BitSight reported at the time.

Costly downtime and disruptions mean even "fire drill" vulnerabilities don't get patched. Boyer refers to BlueKeep, the Remote Desktop Protocol flaw Microsoft disclosed last summer. As of July 2019, about 788,214 systems remain vulnerable to BlueKeep, BitSight found. As of about a week ago, there were still 377,944 systems exposed, Boyer says, citing a new pool of data.

Remote Work Won't Make It Easier
While respondents to Automox's survey say they prioritize patching and hardening their systems, there are several issues that get in the way. Practitioners cite difficulty patching systems belonging to mobile employees and remote offices, inefficient patch testing, lack of visibility into endpoints, and insufficient staffing in both SecOps and IT operations.

Many of today's businesses have begun to support fully remote staff to protect them from the spread of COVID-19. The shift is likely to exacerbate existing patch management challenges. "It's a huge problem," says Boyer of the rapid transition. "You just exploded the attack surface of an organization." Instead of employees working behind a firewall on corporate Wi-Fi, they are working from home networks. Many don't even have a corporate machine, he points out.

"The scale and speed with which it happened is scary, and the environments people are working in now are way different from corporate environments," Boyer continues.

To effectively patch systems in this climate, remote management is needed on every machine. But what if something goes wrong in the middle of an upgrade? What if a user can't log in to an application, or they don't have something installed when they should? If someone's software upgrade doesn't go smoothly and interferes with critical software, are they out of luck? Businesses will be forced to decide on how long someone can hold off on a patch, Boyer explains.

"Remote employees are falling behind in terms of patching," says Goodman. "How is that going to grow over time as organizations face the new work-from-home reality?"

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "What Should I Do If Someone Is Impersonating My Company in a Phishing Campaign?"

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Recommended Reading:

Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
More SolarWinds Attack Details Emerge
Kelly Jackson Higgins, Executive Editor at Dark Reading,  1/12/2021
Vulnerability Management Has a Data Problem
Tal Morgenstern, Co-Founder & Chief Product Officer, Vulcan Cyber,  1/14/2021
Register for Dark Reading Newsletters
White Papers
Current Issue
2020: The Year in Security
Download this Tech Digest for a look at the biggest security stories that - so far - have shaped a very strange and stressful year.
Flash Poll
Assessing Cybersecurity Risk in Today's Enterprises
Assessing Cybersecurity Risk in Today's Enterprises
COVID-19 has created a new IT paradigm in the enterprise -- and a new level of cybersecurity risk. This report offers a look at how enterprises are assessing and managing cyber-risk under the new normal.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2021-01-19
HGiga EIP product lacks ineffective access control in certain pages that allow attackers to access database or perform privileged functions.
PUBLISHED: 2021-01-19
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (document management page) to obtain database schema and data.
PUBLISHED: 2021-01-19
HGiga EIP product contains SQL Injection vulnerability. Attackers can inject SQL commands into specific URL parameter (online registration) to obtain database schema and data.
PUBLISHED: 2021-01-19
** DISPUTED ** fs/nfsd/nfs3xdr.c in the Linux kernel through 5.10.8, when there is an NFS export of a subdirectory of a filesystem, allows remote attackers to traverse to other parts of the filesystem via READDIRPLUS. NOTE: some parties argue that such a subdirectory export is not intended to preven...
PUBLISHED: 2021-01-19
Python 3.x through 3.9.1 has a buffer overflow in PyCArg_repr in _ctypes/callproc.c, which may lead to remote code execution in certain Python applications that accept floating-point numbers as untrusted input, as demonstrated by a 1e300 argument to c_double.from_param. This occurs because sprintf i...