Eskenzi PR ad banner Eskenzi PR ad banner
  • About Us
Thursday, 28 September, 2023
IT Security Guru
Eskenzi PR banner
  • Home
  • Features
  • Insight
  • Channel News
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Channel News
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

Research shows that a lack of attention is being paid to patching vulnerabilities and something has to be done about it

The latest vulnerability stats report by Edgescan reveals the most shocking vulnerability metrics from 2020 

by The Gurus
February 25, 2021
in News
edgescan logo
Share on FacebookShare on Twitter

Edgescan, a full-stack vulnerability management service, has just released their Vulnerability Stat Report for 2021, and it’s confirmed that 2020 really was as bad as we all thought it was. The stats report reveals a number of alarming statistics and trends from 2020, taking a deep-dive into vulnerability metrics from known vulnerabilities (CVE), Malware, Ransomware and visibility standpoint (exposed services). The data used in the report has been compiled by Edgescan from the thousands of global security assessments it performed throughout the past year using its vulnerability management service.

Unsurprisingly, the pandemic has taken a toll on IT systems and due to an increase in remote working since the pandemic remote desktop (RDP and Secure Shell (SSH) exposure increased by as much as 40% in 2020. Edgescan reported that of the one million public-facing Internet endpoints mapped in 2020, a shocking 21,070 appeared to have an exposed database system. These exposed systems made many companies vulnerable to malware and resulted in a substantial rise in the number of vulnerabilities discovered. The most common CVE discovered last years was Logjam (CVE-2015-4000), a vulnerability with cryptosystems using Diffie-Hellman key exchanges of certain key strengths, facilitating man-in-the-middle attacks. 

One of the most commonly discovered critical risk CVE’s found in 2020 was CVE-2018-0598, an untrusted search path vulnerability that allows attackers to gain privileges via a Trojan horse DLL in an unspecified directory. CVE-2015-5600, an OpenSSH vulnerability, and CVE-2019-0708, also known as BlueKeep, the critical bug behind the Wannacry attack of 2018, were the two other most commonly found high critical risk CVEs. BlueKeep (CVE-2019-0708) was also the most frequently occurring CVE’s accounting for almost 30% of malware and ransomware related CVE’s. CVE-2017-0143 was another frequently occurring CVE making up a quarter of all CVE’s detected by Edgescan, while CVE-2017-5638 was the third most commonly recurring CVE. 

Most of the frequently occurring CVE’s were located on non-internet facing systems, indicating that there is a cultural trend not to focus on internal vulnerabilities. This type of trend could result in a ransomware/data exfiltration due to a phishing email or a social engineering attack which it unfortunately did. Edgescan found that ransomware increased as a result of end-user attacks, and when coupled with phishing attacks, the total reached almost 50% in 2020. These unpatched vulnerabilities and ransomware attacks have cost already struggling organizations roughly $20 billion, which is a large increase compared to $11.5 billion in the previous year and $8 billion in 2018.

Furthermore, it is also important to note that many of the more common CVE’s were between 1 and 3 years old despite mitigations/patches being available for these vulnerabilities, with almost  a third of CVE’s being identified in 2015 or earlier, and the oldest vulnerability discovered in 2020 being 21 years old. These outdated and unpatched vulnerabilities are understandably being taken advantage of by malware with 13.4% of all critical risks discovered in 2020 related to unpatched, unsupported or out-of-date systems. These statistics demonstrate that a number of attacks can be avoided simply by updating systems and patching outdated vulnerabilities. 

“We still see high rates of known (i.e. patchable) vulnerabilities which have working exploits in the wild, used by known nation-states and cyber-criminal groups. So yes, patching and maintenance are still challenges, demonstrating that it is not trivial to patch production systems”, said Eoin Keary, CEO and founder of Edgescan. He went on to say that “the web application layer is where the majority of risk still resides, but some lower layer (Host/Operating system/Protocol) issues, if discovered, could also present headaches if exploited. CVE’s as old as 2015 are being used by ransomware and malware toolkits to exploit systems within “the perimeter“. 

Overall, the report has shown that a lack of attention is being paid to patching vulnerabilities. 

Although in many cases high and critical risk issues can be more complex and difficult to fix, at other times it can be a simple patch or system configuration tweak. Remediation rates have risen with organisations taking an average of 84 days to remediate high-risk vulnerabilities, while the average remediation time was 60.3 days, making it clear that by faster actions and simple solutions, breaches could be avoided. 

As always, the report is very helpful in demonstrating that simple steps can be taken in order to protect thousands of companies, as Eoin Keary said, the report “gives a unique insight into what’s going on from a trends and statistics perspective and indeed a snapshot of the overall state of cybersecurity. [It] has become a reliable source for truly representing the global state of cybersecurity vulnerability management,” and we must take heed of the trends found in 2020 as we move forward into 2021. 

 

FacebookTweetLinkedIn
ShareTweet
Previous Post

NHS face legal action following involvement with Palantir

Next Post

Hackers break into an Oxford University Covid-19 laboratory

Recent News

software security

Research reveals 80% of applications developed in EMEA contain security flaws

September 27, 2023
Cyber insurance

Half of organisations with cyber insurance implemented additional security measures to qualify for the policy or reduce its cost

September 27, 2023
Fraud and online banking

Akamai Research Finds the Number of Cyberattacks on European Financial Services More Than Doubled in 2023

September 27, 2023
ICS Reconnaissance Attacks – Introduction to Exploiting Modbus

ICS Reconnaissance Attacks – Introduction to Exploiting Modbus

September 27, 2023

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Channel News
  • Events
    • Most Inspiring Women in Cyber 2022
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

Privacy settings

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Powered by Cookie Information