Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Black Hat Asia
March 26-29, 2019
Singapore
Black Hat USA
August 3-8, 2019
Las Vegas, NV, USA
Black Hat Europe
December 2-5, 2019
London UK
10/22/2018
12:00 PM
Chris Pace, Technology Advocate, EMEA, Recorded Future
Chris Pace, Technology Advocate, EMEA, Recorded Future
Event Updates
50%
50%

The Patching Paradox: A Path to Intelligent Vulnerability Management

Imagine: You're out at sea, sailing through treacherous and uncharted waters. The tips of sharp rocks jutting from the waves give some forewarning of danger, but beneath the surface, twisting reefs and shallow sandbanks threaten to run you aground.

Imagine: You’re out at sea, sailing through treacherous and uncharted waters. The tips of sharp rocks jutting from the waves give some forewarning of danger, but beneath the surface, twisting reefs and shallow sandbanks threaten to run you aground.

As you desperately bail saltwater from the hold and look for ways to patch the holes, you cannot help but lament your fate. You realize, would have been to hire the best sailors and chart your course ahead of time. After all, you would have never come this way if you’d known these waters held so much danger.

In cybersecurity, there’s no such luck as an unsinkable ship or a map that marks all the hazards. The current is always changing and new threats come as quickly as a summer tsunami. This means that the most effective way to improve your security posture is to focus on identifying the risks that will actually affect your organization, and then prioritize patching the associated vulnerabilities.

The Most Dangerous Rock Is the One You’re Sailing Toward

In theory, the best way to stay protected is to keep every system you use up to date by patching every vulnerability as soon as it’s identified and always using the newest software. In practice, this “patch everything, everywhere” approach is almost impossible to sustain. Even though any one organization will only use software that represents a small proportion of this number, any cybersecurity team that tries to keep their systems completely up to date day after day will find themselves overburdened and unable to do any other work.

The obvious conclusion is to prioritize patching the vulnerabilities that put your organization at the most risk. But quantifying that risk is not as easy as focusing on vulnerabilities with the highest severity score. It’s not the zero-day exploits that nobody has a defense against or some other clever new threat that does the most damage, but vulnerabilities that people know about but just haven’t gotten around to patching.

Open Waters

Deciding how to respond to threats needs to be based on real risks supported by good data. Use automated vulnerability management tools to quickly identify which parts of your system need critical care, and then prioritize those vulnerabilities with threat intelligence that tells you which vulnerabilities are actually most liable to be exploited.

To learn more about how external threat intelligence can help your organization uncover the vulnerabilities in your system that threat actors could be exploiting right now, download our free white paper, “Vulnerability Intelligence From the Dark Web: The Disclosure to Exploit Risk Race.”

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Active Directory Needs an Update: Here's Why
Raz Rafaeli, CEO and Co-Founder at Secret Double Octopus,  1/16/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.
CVE-2020-7222
PUBLISHED: 2020-01-18
An issue was discovered in Amcrest Web Server 2.520.AC00.18.R 2017-06-29 WEB 3.2.1.453504. The login page responds with JavaScript when one tries to authenticate. An attacker who changes the result parameter (to true) in this JavaScript code can bypass authentication and achieve limited privileges (...