Software and system updates have been one of the main points of attention in the initial securing of systems for more than a decade. Microsoft in 2001-2003 launched advanced mechanisms for securing its own systems. That's when hfnetchck (tools to check for installed or missing patches) appeared and shortly afterwards the Windows Update service or SUS (Software Update Services now WSUS - Windows Server Update Service).
These services mainly covered components of Microsoft systems and applications and the need was and is also in the central updating of other applications. Flexera Software, after its acquisition of Secunia, has become a leading but not the only provider of IT security solutions that allow companies to manage and inspect vulnerabilities and a central base for updating tens of thousands of applications. Flexera provides the Corporate Software Inspector product, which integrates with the WSUS service and SCCM (System Center Configuration Manager) and allows you to find missing patches and distribute them through WSUS or SCCM.
We have prepared the following study on the basis of the "Vulnerability Review 2018" report, which presents in a clear way an analysis of the most common vulnerabilities in software, applications, as well as a methodology for "counting" vulnerabilities based on the statistics of vulnerabilities present in a given type of product, and supported with author's comments. This report should be considered as a supplement to the knowledge of IT departments in building security policies and procedures, taking into account in particular software security vulnerabilities.
In the first part, we will talk about the types of vulnerabilities, their effects, and present numbers and data on the number of vulnerabilities by manufacturer, threat ranking and the most common attack vectors.
In the second part of the report, we will present information on software updates, a description of the Zero-Day vulnerability, and discuss the metrics and mechanisms used in analyzing the data for this report.
Part 1: Software Vulnerability on Censorship. Flexera's "Vulnerability Review 2018" report.
The year 2017 will be remembered for a long time to come, indeed, just like 2016. Spectacular data leaks and high-profile stories of companies falling prey to hackers were the result of software security vulnerabilities that became a critical flashpoint. The ransomware Petya or WannaCry spent sleepless nights for IT departments and company boards, raising questions about the quality of security, the amount of effort put into enhancing security, and the ability to identify threats to the
with the exploitation of vulnerabilities in their software. Various independent and commercial laboratories show the increasing number of threats, and we learn about the spectacular effects of attacks and blocking of Polish companies no longer only from trade magazines, but also news appearing on general portals.
We have the knowledge and... we are afraid to use it.
Many organizations do not have the right processes and procedures in place (often having the knowledge
and experienced experts!) that should reduce the number of vulnerabilities in their software. This also translates into a lack of processes that combine identification of hotspots with methods to fix them. This space allows hackers to seamlessly navigate through systems and applications, manipulating permissions to steal valuable identities and sensitive data. What's more, it's apparent that attacks are increasingly complex multi-stage attacks, and in many cases one of the essential elements of such attacks is the exploitation of vulnerabilities in applications.
Intelligence and process must go hand in hand.
One of the most frequently observed phenomena is so-called "firefighting." Rather than launching pre-prepared, automated procedures to detect and counter threats, companies often interrupt their production processes to deal with an emergency at a given time. This approach is ineffective if it is not process-based. It requires a lot of time, effort and labor costs. With security vulnerabilities growing rapidly, we are seeing increased pressure on companies to implement the best possible methods to detect and counter the effects of data leakage.
Hard facts.
- More than 20,000 vulnerabilities were identified and described in 2017 alone. This shows the magnitude of the risks and challenges for business to make appropriate security-enhancing investments.
- Updates and patches are available for more than 86% of known software on the day they are detected. This means that companies need to do an even better job of monitoring the health of software and have processes that can identify threats before they are detected.
- Declining number of Zero-Day vulnerabilities. Only 14 of the analyzed 19,954 sites were identified. This fact proves that there is still room for even better programming of intelligent code analysis and threat detection mechanisms.
Report in numbers.
The number of vulnerabilities discovered is 19,954 discovered in more than 1,865 applications from 259 vendors. This number shows an increase of 38% in the five-year trend and also a 14% increase from 2016 to 2017.
Since 2016, the number of manufacturers providing software has increased by 3%. A good sign is that the number of sensitive products has decreased by 13%.
Between 2012 and 2016, 14,501 vulnerabilities were detected in 2,965 products offered by 446 manufacturers. In 2017, 19,954 vulnerabilities were detected in 1,865 products offered by 259 manufacturers. Based on the analyzed years (2012-2016 to 2017), a change in the decrease of vulnerabilities from 38% to 14% was observed, as well as a decrease in the number of vulnerable applications from 37% to 13%.
In the metric analyzed, a more than 2-fold increase in vulnerability has been observed since 2012
in the analyzed solutions: 2012 - 9,895 vulnerabilities, 2016 - 17,445 vulnerabilities, 2017 - 19,954 vulnerabilities (an increase from 2016 to 2017 of 14%).
Starting in 2012, the trend shows a clear decline in the products and solutions offered to the market. This is more than twice as low as in 2012. (596 manufacturers and 3,094 products) compared to 2017 (259 manufacturers and 1,865 products).
16.6% of the analyzed vulnerabilities in 2017 were marked as critical and only 0.3% as highly critical. No significant changes were observed at this level with respect to 2016-2017. Full analysis:
- Highly critical: 0.3%
- Critical: 16.6%
- Medium: 31.4%
- Low: 38.9%
- Very low/none: 12.9%
The most common attack vector in 2017 (over 55.3% of all those analyzed) was the remote network. This is a slight decrease from the 55.9% they had a year earlier. This means that more than half of all security vulnerabilities can be exploited remotely. The percentage of these vulnerabilities in local network security increased from 31.5% in 2016 to 32.1% in 2017. Vulnerabilities in the local system, as a potential attack vector, remained at the same level in 2017 (12.6%).
ISCG is an authorized supplier of Flexera solutions in Poland. We integrate our solutions with WSUS/SCCM technologies enhancing the capabilities of these solutions. Projects completed to date in the financial and commercial sectors have scaled environments from hundreds of workstations to over 10,000 stations. We offer our clients a fast track to test the solution and integrate it with currently used systems.
Source: Flexera 2018 Survey and Report (www.flexera.com)