Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

3/3/2020
04:30 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

Gotta Patch 'Em All? Not Necessarily, Experts Say

When it's impossible to remediate all vulnerabilities in an organization, data can indicate which bugs should be prioritized.

Modern security teams face a daunting task in keeping up with a growing amount of vulnerabilities. While they may not be able to patch all the flaws in their environments, they can cut down on risk by prioritizing high-risk vulnerabilities that are most likely to be exploited.

The volume of published common vulnerabilities and exposures (CVEs) has dramatically increased over the past 20 years, said Benjamin Edwards, senior data scientist with the Cyentia Institute, during the RSA Conference panel "Measuring Vulnerability Remediation Strategies with Real-World Data." Between 1999 and 2004, an average of 1,300 vulnerabilities were published per year. That number increased to 6,100 per year from 2005 to 2016 and then jumped to 18,000 per year for 2017 to 2020, he explained.

"Recently the number of vulnerabilities has increased quite a bit because we have expanded the number of people who can report and categorize CVEs," Edwards continued. Right now, there are more than 130,000 published vulnerabilities that can potentially affect organizations.

It's an overwhelming number denoting a common enterprise problem. Any given business, regardless of size, can patch one in 10 vulnerabilities each month, said Edwards. The data comes from "Prioritization to Prediction, Volume 4: Measuring What Matters in Remediation," a report recently published by the Cyentia Institute and Kenna Security based on a survey of about 100 organizations.

Forty percent of vulnerabilities in enterprise networks are still open today, researchers found. The median time to remediation is 100 days, and 25% of flaws remain open longer than a year. But, as Edwards pointed out, some vulnerabilities are more dangerous than others. There are flaws that affect millions of assets and those that affect hundreds, those that are easy to exploit and those that are difficult, he says. "Can you fix everything? Nope, not even close," Edwards said.

The next question becomes, "Can I remediate vulnerabilities before exploitation?" said Wade Baker, Cyentia Institute partner and co-founder. Chances are you won't patch vulnerabilities before they are weaponized, but you may be able to remediate them before an attacker uses them against you.

"About when a CVE is published, if it's exploited, it happens quickly," Baker continued, noting that zero-days and proof-of-concepts may happen before a flaw is disclosed. "The publication of a vulnerability is a trigger for exploitation, in many cases." Cyentia Institute researchers found 23% of vulnerabilities with published CVEs have associated exploit code.

Exploitation unfolds gradually. The timeline appears like a plateau in which activity initially spikes and then extends for nearly two-and-a-half years after the first exploit, he added. After about three years of activity, the likelihood of that vulnerability being exploited in the wild drops off.

What to Consider in A Remediation Program
The key to effective vulnerability management is knowing which flaws you should prioritize patching. You may not have the capacity to patch everything, but you do have the ability to learn which vulnerabilities are being exploited in the wild and which are in your environment. The research data shows one-third of published CVEs are observed in enterprise environments.

Remediation takes time. According to the research, 40% of vulnerabilities are remediated within the first month and half within the first two months. Nearly one-quarter of vulnerabilities are still open after a year.

The flaws to prioritize are those that have been both observed in enterprise environments and exploited in the wild, which applied to only 5% of all CVEs, researchers found. The "vast majority" (69%) of vulnerabilities never appear in a customer environment, Edwards said. More than half (54%) are never exploited in the wild or seen in enterprise environments. If attackers have not seen a flaw and nobody is using it, it's less of a concern to security teams.

Two in three organizations successfully remediate high-risk vulnerabilities, with 51% reducing the number of high-risk flaws in their environments and 17% maintaining the same level. Those paying down vulnerability debt are doing so with improved focus and execution, Baker said, pointing to four metrics firms can use to measure better or worse remediation performance:

  • Coverage: How comprehensive the remediation is; the percentage of exploited or high-risk flaws addressed.
  • Efficiency: How precise the remediation is; how many patched flaws are high-risk?
  • Velocity: The speed and progress of the remediation.
  • Capacity: Number of flaws that can be patched in a given timeframe and net gain/loss.

"There is statistically significant evidence that if you try to apply risk-based vulnerability management principles across large portions of your environment, you will fix vulnerabilities faster," Baker said. Researchers also found a simpler remediation process yielded better coverage, whereas more complex processes led to less coverage but slightly better velocity. Programs with adequate budgets fared better than those that lacked enough funds, he added.

The structure of vulnerability management programs made a difference. Time to remediate was about a month-and-a-half shorter among firms that place responsibilities for finding and fixing flaws in separate organizations. This separation of duties also led to higher capacity for remediation, meaning these businesses are less likely to fall behind. Researchers hypothesized having separate teams identify and remediate flaws indicates more resources and maturity.

Researchers also found 40% believed their vulnerability management programs were average, 36% considered them above average, 14% said they were below average, and 8% said they were in the top 10%. "People who think they're above average tend to be above average," Edwards said. "I was surprised at how well people knew their own programs."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "With New SOL4Ce Lab, Purdue U. and DoE Set Sights on National Security."

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 5/22/2020
How an Industry Consortium Can Reinvent Security Solution Testing
Henry Harrison, Co-founder & Chief Technology Officer, Garrison,  5/21/2020
10 iOS Security Tips to Lock Down Your iPhone
Kelly Sheridan, Staff Editor, Dark Reading,  5/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13442
PUBLISHED: 2020-05-25
A Remote code execution vulnerability exists in DEXT5Upload in DEXT5 through 2.7.1402870. An attacker can upload a PHP file via dext5handler.jsp handler because the uploaded file is stored under dext5uploadeddata/.
CVE-2020-5537
PUBLISHED: 2020-05-25
Cybozu Desktop for Windows 2.0.23 to 2.2.40 allows remote code execution via unspecified vectors.
CVE-2020-13438
PUBLISHED: 2020-05-24
ffjpeg through 2020-02-24 has an invalid read in jfif_encode in jfif.c.
CVE-2020-13439
PUBLISHED: 2020-05-24
ffjpeg through 2020-02-24 has a heap-based buffer over-read in jfif_decode in jfif.c.
CVE-2020-13440
PUBLISHED: 2020-05-24
ffjpeg through 2020-02-24 has an invalid write in bmp_load in bmp.c.