Eskenzi PR ad banner Eskenzi PR ad banner
  • About Us
Wednesday, 8 February, 2023
IT Security Guru
Eskenzi PR banner
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

Only 26% of researched security vulnerabilities are resolved

by The Gurus
June 18, 2018
in Editor's News
vulnerability
Share on FacebookShare on Twitter

New analysis from NCC Group has revealed that only 26% of vulnerabilities discovered over the last nine years by its research team are likely to have been fixed.

For the first time, the global cyber security and risk mitigation expert analysed nine years of vulnerabilities discovered by its researchers. Of these, just 289 were classed as “closed”, meaning they were either fixed or dismissed once the risk was accepted by the vendor. Of these resolved cases, the average number of days between reporting a vulnerability and its resolution exceeded an industry-accepted 30-day notice period at every level of risk.

The highest average number of days to resolve vulnerabilities was associated with those that were low-risk, which took 96 days to fix on average. Critical and medium-risk vulnerabilities closely followed, with it taking on average 74 and 77 days to resolve these vulnerabilities respectively.

Often, this delay was due to NCC Group researchers having no clear point of contact with whom to disclose the vulnerability. In many cases, staff resorted to contacting social media teams in an effort to find a secure channel of communication through which to disclose the vulnerability, often with no response.

This analysis also uncovered that only 2.4% of vulnerabilities found and reported resulted in a CVE – a number used to uniquely identify a vulnerability with the aim of providing a comprehensive list of all publicly known vulnerabilities.

Matt Lewis, research director at NCC Group, said: “Our analysis highlights a clear knowledge gap when it comes to the resolution of vulnerabilities. Improving our industry’s ability to detect vulnerabilities before they become an issue is less of an achievement without an established process in place for their remediation and disclosure.

“There also seems to be a false sense of security among businesses when it comes to low-risk vulnerabilities. These are vulnerabilities nonetheless, and we’re seeing an increase in bug chaining attacks, which exploit multiple low-risk issues across infrastructure to achieve full, unauthorised control of the underlying system.

“The fact that the majority of vulnerabilities uncovered by our researchers over the last nine years have not been fixed demonstrates that there are likely far more zero-day vulnerabilities in existence than we might think.”

FacebookTweetLinkedIn
ShareTweetShare
Previous Post

How can real-time payments be secured?

Next Post

Apple fixed firmware vulnerability found by Positive Technologies

Recent News

Cato Networks delivers first CASB for instant visibility and control of cloud application data risk

Cato SASE Cloud Named “Leader” and “Outperformer” in GigaOm Radar Report for SD-WAN

February 7, 2023
AT&T Cybersecurity grows SASE offering by adding Palo Alto Networks

UK second most targeted nation behind America for Ransomware

February 7, 2023
safe

Will Emphasising App Security Lead to More App Installs?

February 6, 2023
Phone with app store open

$400,000 Fine for Stalkerware App Developer

February 6, 2023

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

Privacy settings

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Powered by Cookie Information