Cloud

8/22/2018
04:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

It Takes an Average 38 Days to Patch a Vulnerability

Analysis of 316 million-plus security incidents uncovers most common types of real-world attacks taking place within in-production Web apps in the AWS and Azure cloud ecosystems.

It takes over a month for the average organization to patch its most critical vulnerabilities, according to a new report detecting trends in Web application attacks.

The data comes from tCell, which today released its Q2 2018 "Security Report for In-Production Web Applications." Researchers analyzed more than 316 million security incidents across its customer base and published key findings on the most common types of real-world attacks taking place within in-production Web apps in the Amazon Web Services and Microsoft Azure cloud ecosystems.

TCell published the report for the first time last year, when it noted a high attack-to-breach ratio, explains co-founder and CEO Michael Feiertag. The volume of attempts that attackers go through before landing a successful breach are 100,000 to 1, he says. Web application attacks are noisy because attackers use automation to hunt weak spots within the apps.

"This year we evaluated the data over the last quarter to understand how access to security data from the application has impacted the team's ability to secure their apps," he continues. "We discovered that security teams who have this data gained measurable process improvements for remediation, used the data to improve collaboration with developer and operations peers, and helped prioritize work to gain scale for overstretched teams."

Researchers recognized two primary attacks at play. One was the prevalence of attempted cross-site scripting (XSS) attacks aimed at application users, which were the most common type of incident detected. Most instances of XSS are only attack attempts, they point out. Last year, only one in 1,200 attempts were successful, making it tough to separate breaches from attack attempts.

The second most common was SQL injection, which was leveraged to access sensitive data or run OS commands to gain further access into a target system. Automated threats, fire path traversal, and command injection rounded out the top five most common Web application attacks for Q2.

"We are seeing a bifurcation of attacks," Feiertag says. The majority, by volume, are scanning attacks in which probes target many apps with every possible easy-to-test attack. Researchers also saw a spike in targeted attacks, which hit individual apps with advanced threats going for high-value vulnerabilities: command injection to put malicious code on a server, for example, or compromised credentials to gain administrative access.

"Both appear to be financially motivated but with different approaches to achieve those goals – wide vs. deep," he adds.

TCell's top five most common incidents differ from the most popular attacks as listed by the Open Web Application Security Project (OWASP); those are injection flaws, broken authentication, sensitive data exposure, XML external entities, and broken access control. The reason is that tCell specifically considers attacks and breaches in production that reside in public cloud environments, while OWASP considers a broader set of data, which provides "a different view on the same problem," Feiertag explains.

CVEs: Prevalence and Patching
According to tCell's report, 90% of active applications had a known CVE, tCell says, while 30% had a critical CVE during the second quarter. Experts detected an average of 2,900 orphaned routes or exposed API endpoints per application, which signify an attack surface with no current business function and represent a security "blind spot," they explain in their report.

It took an average of 38 days for an organization to patch a vulnerability, regardless of its severity level, and 34 days for an organization to patch its most critical CVEs. Those stats may be affected by the size of the organization, researchers noted, given how larger businesses take significantly longer to patch vulnerabilities than smaller ones.

The less severe the vulnerability, the longer the time frame. Medium severity vulnerabilities took an average of 39 days to patch; low severity flaws took an average of 54 days. The oldest unpatched CVE took nearly a year – 340 days – to address.

Feiertag says the numbers have gotten better. "We've seen our customers significantly decrease their time to remediate rates," he notes, with teams becoming more aware of the need to roll out patches quickly.

Web App Security: What Companies Are Doing
Forward-looking companies are adopting application security approaches that integrate with DevOps and the cloud, Feiertag says. The technologies enabling this, such as RASP, are newer and still evolving but are an improvement over WAF, AST, and waterfall SDLC processes.

However, he continues, many teams and companies have not embraced this change and continue to fall behind, with their software and infrastructure getting ahead of their security tools and strategies.

"Ironically, those are frequently the companies that spend the most money on security, but the results that they achieve are generally below that of their more flexible and efficient peers," Feiertag says. He advises companies to understand their specific risks – "If you have an app on the Internet, it'll get attacked eventually," he says – and to use the right tools and data to minimize them.

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Strategist
8/24/2018 | 5:17:33 PM
I enjoyed reading the post
Interesting comment from one of the researchers, "Last year, only one in 1,200 attempts were successful, making it tough to separate breaches from attack attempts.". So last year, the money count was 9.7 Billion dollars, so 9,700,000,000/1200 = 8,083,333.33. So that means on average, they came out with 8M. I am not sure about you, but that is pretty extensive for someone not working or investing in the stock market.

"The second most common was SQL injection, which was leveraged to access sensitive data or run OS commands to gain further access into a target system. " - Maybe I missed something, I thought the first rule of thumb would be to install the database on a separate system other than the DB/Application sitting together, I think from that standpoint, isn't the person asking for trouble, just a rule of thumb.

"those are injection flaws, broken authentication, sensitive data exposure, XML external entities, and broken access control." - And isn't this just plain human error and no oversight on the part of the manager or director.

RASP - Run-Time Application Self Protection. This is interesting, they are developing this for the various phones but I don't see the development for servers or desktops. I do think machine learning is taking over in this space where the algorithms and teaching sequences are getting more complicated and the systems are learning. There was an incident where Facebook allowed two machines to learn from each other, they allowed the machine to communicate with each other and the systems started communicating with each other in a totally different language, the researchers were so frightened of the incident that they stopped the research project all together - https://goo.gl/2VcyRw. The last time I looked at Transformers, this occurred as well. All I can say is wow, we should have allowed them to communicate in a controlled environment to see what they would have come up with, they probably would have gone out of the electrical circuits to learn all the human behavior flaws, that would have been interesting.

"If you have an app on the Internet, it'll get attacked eventually," he says – and to use the right tools and data to minimize them." - I especially agree with this point, but at the end of the day, isn't security a facade, at the end of the day if we look into the imperceivable deep areas of the mind, where if put in the right circumstances, we would all break down and do the things that we said we would not (whether it would be money, fame, prestige or family concerns). I hope I never run down that path but who knows, only the future holds that truth.

Please keep the wonderful articles coming.

Todd

 
6 Security Trends for 2018/2019
Curtis Franklin Jr., Senior Editor at Dark Reading,  10/15/2018
6 Reasons Why Employees Violate Security Policies
Ericka Chickowski, Contributing Writer, Dark Reading,  10/16/2018
Getting Up to Speed with "Always-On SSL"
Tim Callan, Senior Fellow, Comodo CA,  10/18/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Latest Comment: Too funny!
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-10839
PUBLISHED: 2018-10-16
Qemu emulator <= 3.0.0 built with the NE2000 NIC emulation support is vulnerable to an integer overflow, which could lead to buffer overflow issue. It could occur when receiving packets over the network. A user inside guest could use this flaw to crash the Qemu process resulting in DoS.
CVE-2018-13399
PUBLISHED: 2018-10-16
The Microsoft Windows Installer for Atlassian Fisheye and Crucible before version 4.6.1 allows local attackers to escalate privileges because of weak permissions on the installation directory.
CVE-2018-18381
PUBLISHED: 2018-10-16
Z-BlogPHP 1.5.2.1935 (Zero) has a stored XSS Vulnerability in zb_system/function/c_system_admin.php via the Content-Type header during the uploading of image attachments.
CVE-2018-18382
PUBLISHED: 2018-10-16
Advanced HRM 1.6 allows Remote Code Execution via PHP code in a .php file to the user/update-user-avatar URI, which can be accessed through an "Update Profile" "Change Picture" (aka user/edit-profile) action.
CVE-2018-18374
PUBLISHED: 2018-10-16
XSS exists in the MetInfo 6.1.2 admin/index.php page via the anyid parameter.