Cloud

8/22/2018
04:45 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
100%
0%

It Takes an Average 38 Days to Patch a Vulnerability

Analysis of 316 million-plus security incidents uncovers most common types of real-world attacks taking place within in-production Web apps in the AWS and Azure cloud ecosystems.

It takes over a month for the average organization to patch its most critical vulnerabilities, according to a new report detecting trends in Web application attacks.

The data comes from tCell, which today released its Q2 2018 "Security Report for In-Production Web Applications." Researchers analyzed more than 316 million security incidents across its customer base and published key findings on the most common types of real-world attacks taking place within in-production Web apps in the Amazon Web Services and Microsoft Azure cloud ecosystems.

TCell published the report for the first time last year, when it noted a high attack-to-breach ratio, explains co-founder and CEO Michael Feiertag. The volume of attempts that attackers go through before landing a successful breach are 100,000 to 1, he says. Web application attacks are noisy because attackers use automation to hunt weak spots within the apps.

"This year we evaluated the data over the last quarter to understand how access to security data from the application has impacted the team's ability to secure their apps," he continues. "We discovered that security teams who have this data gained measurable process improvements for remediation, used the data to improve collaboration with developer and operations peers, and helped prioritize work to gain scale for overstretched teams."

Researchers recognized two primary attacks at play. One was the prevalence of attempted cross-site scripting (XSS) attacks aimed at application users, which were the most common type of incident detected. Most instances of XSS are only attack attempts, they point out. Last year, only one in 1,200 attempts were successful, making it tough to separate breaches from attack attempts.

The second most common was SQL injection, which was leveraged to access sensitive data or run OS commands to gain further access into a target system. Automated threats, fire path traversal, and command injection rounded out the top five most common Web application attacks for Q2.

"We are seeing a bifurcation of attacks," Feiertag says. The majority, by volume, are scanning attacks in which probes target many apps with every possible easy-to-test attack. Researchers also saw a spike in targeted attacks, which hit individual apps with advanced threats going for high-value vulnerabilities: command injection to put malicious code on a server, for example, or compromised credentials to gain administrative access.

"Both appear to be financially motivated but with different approaches to achieve those goals – wide vs. deep," he adds.

TCell's top five most common incidents differ from the most popular attacks as listed by the Open Web Application Security Project (OWASP); those are injection flaws, broken authentication, sensitive data exposure, XML external entities, and broken access control. The reason is that tCell specifically considers attacks and breaches in production that reside in public cloud environments, while OWASP considers a broader set of data, which provides "a different view on the same problem," Feiertag explains.

CVEs: Prevalence and Patching
According to tCell's report, 90% of active applications had a known CVE, tCell says, while 30% had a critical CVE during the second quarter. Experts detected an average of 2,900 orphaned routes or exposed API endpoints per application, which signify an attack surface with no current business function and represent a security "blind spot," they explain in their report.

It took an average of 38 days for an organization to patch a vulnerability, regardless of its severity level, and 34 days for an organization to patch its most critical CVEs. Those stats may be affected by the size of the organization, researchers noted, given how larger businesses take significantly longer to patch vulnerabilities than smaller ones.

The less severe the vulnerability, the longer the time frame. Medium severity vulnerabilities took an average of 39 days to patch; low severity flaws took an average of 54 days. The oldest unpatched CVE took nearly a year – 340 days – to address.

Feiertag says the numbers have gotten better. "We've seen our customers significantly decrease their time to remediate rates," he notes, with teams becoming more aware of the need to roll out patches quickly.

Web App Security: What Companies Are Doing
Forward-looking companies are adopting application security approaches that integrate with DevOps and the cloud, Feiertag says. The technologies enabling this, such as RASP, are newer and still evolving but are an improvement over WAF, AST, and waterfall SDLC processes.

However, he continues, many teams and companies have not embraced this change and continue to fall behind, with their software and infrastructure getting ahead of their security tools and strategies.

"Ironically, those are frequently the companies that spend the most money on security, but the results that they achieve are generally below that of their more flexible and efficient peers," Feiertag says. He advises companies to understand their specific risks – "If you have an app on the Internet, it'll get attacked eventually," he says – and to use the right tools and data to minimize them.

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
User Rank: Strategist
8/24/2018 | 5:17:33 PM
I enjoyed reading the post
Interesting comment from one of the researchers, "Last year, only one in 1,200 attempts were successful, making it tough to separate breaches from attack attempts.". So last year, the money count was 9.7 Billion dollars, so 9,700,000,000/1200 = 8,083,333.33. So that means on average, they came out with 8M. I am not sure about you, but that is pretty extensive for someone not working or investing in the stock market.

"The second most common was SQL injection, which was leveraged to access sensitive data or run OS commands to gain further access into a target system. " - Maybe I missed something, I thought the first rule of thumb would be to install the database on a separate system other than the DB/Application sitting together, I think from that standpoint, isn't the person asking for trouble, just a rule of thumb.

"those are injection flaws, broken authentication, sensitive data exposure, XML external entities, and broken access control." - And isn't this just plain human error and no oversight on the part of the manager or director.

RASP - Run-Time Application Self Protection. This is interesting, they are developing this for the various phones but I don't see the development for servers or desktops. I do think machine learning is taking over in this space where the algorithms and teaching sequences are getting more complicated and the systems are learning. There was an incident where Facebook allowed two machines to learn from each other, they allowed the machine to communicate with each other and the systems started communicating with each other in a totally different language, the researchers were so frightened of the incident that they stopped the research project all together - https://goo.gl/2VcyRw. The last time I looked at Transformers, this occurred as well. All I can say is wow, we should have allowed them to communicate in a controlled environment to see what they would have come up with, they probably would have gone out of the electrical circuits to learn all the human behavior flaws, that would have been interesting.

"If you have an app on the Internet, it'll get attacked eventually," he says – and to use the right tools and data to minimize them." - I especially agree with this point, but at the end of the day, isn't security a facade, at the end of the day if we look into the imperceivable deep areas of the mind, where if put in the right circumstances, we would all break down and do the things that we said we would not (whether it would be money, fame, prestige or family concerns). I hope I never run down that path but who knows, only the future holds that truth.

Please keep the wonderful articles coming.

Todd

 
Microsoft, Mastercard Aim to Change Identity Management
Kelly Sheridan, Staff Editor, Dark Reading,  12/3/2018
Windows 10 Security Questions Prove Easy for Attackers to Exploit
Kelly Sheridan, Staff Editor, Dark Reading,  12/5/2018
Starwood Breach Reaction Focuses on 4-Year Dwell
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/5/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: I guess this answers the question: who's watching the watchers?
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-19653
PUBLISHED: 2018-12-09
HashiCorp Consul 0.5.1 through 1.4.0 can use cleartext agent-to-agent RPC communication because the verify_outgoing setting is improperly documented. NOTE: the vendor has provided reconfiguration steps that do not require a software upgrade.
CVE-2018-19982
PUBLISHED: 2018-12-09
An issue was discovered on KT MC01507L Z-Wave S0 devices. It occurs because HPKP is not implemented. The communication architecture is APP > Server > Controller (HUB) > Node (products which are controlled by HUB). The prerequisite is that the attacker is on the same network as the target HU...
CVE-2018-19983
PUBLISHED: 2018-12-09
An issue was discovered on Sigma Design Z-Wave S0 through S2 devices. An attacker first prepares a Z-Wave frame-transmission program (e.g., Z-Wave PC Controller, OpenZWave, CC1110, etc.). Next, the attacker conducts a DoS attack against the Z-Wave S0 Security version product by continuously sending ...
CVE-2018-19980
PUBLISHED: 2018-12-08
Anker Nebula Capsule Pro NBUI_M1_V2.1.9 devices allow attackers to cause a denial of service (reboot of the underlying Android 7.1.2 operating system) via a crafted application that sends data to WifiService.
CVE-2018-19961
PUBLISHED: 2018-12-08
An issue was discovered in Xen through 4.11.x on AMD x86 platforms, possibly allowing guest OS users to gain host OS privileges because TLB flushes do not always occur after IOMMU mapping changes.