Patched Vulnerabilities Big Breach Cause

Wednesday, February 25, 2015 @ 04:02 PM gHale

It is the same old story, patches don’t end up used and it comes back to bite the company in the long run, a new study is showing.

Organizations are not properly patching because 44 percent of known breaches were possibly the result of vulnerabilities identified years ago, according to the just released HP Cyber Risk Report 2015.

RELATED STORIES
Finding a Balance: Managing OT Cyber Risk
Employee Training Boosts Security
Cyber Attacks Top Continuity Threat
Complex Security Should be Easy

Accounting for 33 percent of identified exploit samples in 2014 is a Microsoft Windows vulnerability identified as CVE-2010-2568. This was one of the infection vectors used in Stuxnet.

The report shows CVE-2010-0188, a vulnerability in Adobe Reader and Acrobat, accounted for 11 percent of exploit samples in 2014. Six Oracle Java bugs identified in 2012 and 2013 also made the top ten list, as well as two Microsoft Office flaws – one identified in 2009 and the other in 2012.

In the manufacturing sector, it is not as easy as simply applying a patch when it becomes available, but users do have to weigh the risk vs. reward principal and see how it works out.

Another significant issue noted in the report is server misconfigurations.

According to the report, penetration testing coupled with internal and external analyses of configurations can help in identifying issues.

Looking in the crystal ball for this year, users should expect to see more open source vulnerabilities, more SCADA attacks, and more of a focus on infrastructure. In addition, attackers will continue to have success exploiting unpatched vulnerabilities.

Key findings from the report include:
• 44 percent of known breaches came from vulnerabilities that are 2-4 years old. Attackers continue to leverage well-known techniques to successfully compromise systems and networks.
• Server misconfigurations were the number one vulnerability. Over and above vulnerabilities such as privacy and cookie security issues, server misconfigurations dominated the list of security concerns in 2014, providing attackers unnecessary access to files that leave an organization susceptible to an attack.
• Additional avenues of attack introduced via connected devices. In addition to security issues presented via Internet of Things (IoT) devices, 2014 also saw an increase in the level of mobile malware detected.
• Primary causes of commonly exploited software vulnerabilities are defects, bugs, and logic flaws. Most vulnerabilities stem from a relatively small number of common software programming errors. Old and new vulnerabilities in software end up swiftly exploited by attackers.

Click here to register for the report.



Leave a Reply

You must be logged in to post a comment.