There May Be a Ceiling on Vulnerability Remediation

Most organizations are doing all they can to keep up with the release of vulnerabilities, new research shows.

Dark Reading logo in a gray background | Dark Reading

Security has no shortage of metrics — everything from the number of vulnerabilities and attacks to the number of bytes per second in a denial-of-service attack. Now a new report focuses on how long it takes organizations to remediate vulnerabilities in their systems — and just how many of the vulnerabilities they face they're actually able to fix.

The report, "Prioritization to Prediction Volume 3: Winning the Remediation Race," by Kenna Security and the Cyentia Institute, contains both discouraging and surprising findings.

Among the discouraging findings are statistics that show companies have the capacity to close only about 10% all the vulnerabilities on their networks. This percentage doesn't change much by company size.

"Whether it was a small business that had, on average, 10 to 100 open vulnerabilities at any given time, they had roughly the same percentage of vulnerabilities they could remediate as the large enterprises, where they had 10 million-plus open vulnerabilities per month," says Ed Bellis, CTO and co-founder of Kenna Security, 

In other words, Bellis said, the capacity to remediate seems to increase at approximately the same rate as the need to remediate. "The size thing that tipped us off that there might be some upper threshold on what organizations were able to to fix in a given time frame," says Wade Baker, partner and co-founder of the Cyentia Institute., 

The time frame for remediating vulnerabilities differs depending on the software's publisher. Microsoft and Google tend to have software with vulnerabilities remediated most quickly by organizations both large and small, Bellis says. The software with the longest remediation time? Legacy software and code developed in-house.

There are also dramatic differences in time to remediate between companies in different industries. Investment, transportation, and oil/gas/energy led the way in the shortest time to close 75% of exploited vulnerabilities, hitting that mark in as few as 112 days. Healthcare, insurance, and retail/trade took the longest for remediation, needing as much as 447 days to hit the milestone.

Data suggests that some organizations are able to do better than the averages — in some cases, remediating more vulnerabilities than were discovered and actually getting ahead of the problem. What the researchers don't yet know is precisely what those high-performing companies are doing that is different. That, they say, is the subject of the next volume of their research.

Related Content:

 

 

 

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industry's most knowledgeable IT security experts. Check out the Interop agenda here.

About the Author

Curtis Franklin, Principal Analyst, Omdia

Curtis Franklin Jr. is Principal Analyst at Omdia, focusing on enterprise security management. Previously, he was senior editor of Dark Reading, editor of Light Reading's Security Now, and executive editor, technology, at InformationWeek, where he was also executive producer of InformationWeek's online radio and podcast episodes

Curtis has been writing about technologies and products in computing and networking since the early 1980s. He has been on staff and contributed to technology-industry publications including BYTE, ComputerWorld, CEO, Enterprise Efficiency, ChannelWeb, Network Computing, InfoWorld, PCWorld, Dark Reading, and ITWorld.com on subjects ranging from mobile enterprise computing to enterprise security and wireless networking.

Curtis is the author of thousands of articles, the co-author of five books, and has been a frequent speaker at computer and networking industry conferences across North America and Europe. His most recent books, Cloud Computing: Technologies and Strategies of the Ubiquitous Data Center, and Securing the Cloud: Security Strategies for the Ubiquitous Data Center, with co-author Brian Chee, are published by Taylor and Francis.

When he's not writing, Curtis is a painter, photographer, cook, and multi-instrumentalist musician. He is active in running, amateur radio (KG4GWA), the MakerFX maker space in Orlando, FL, and is a certified Florida Master Naturalist.

Keep up with the latest cybersecurity threats, newly discovered vulnerabilities, data breach information, and emerging trends. Delivered daily or weekly right to your email inbox.

You May Also Like


More Insights