2018 Vulnerability Stats Report - Simple things make the difference.

By -


We finally finished off the 2018 edgescan Vulnerability Stats report this week.
Overall things have not changed too much but we did a little more digging into the vulnerability data we harvested over the 12 months to December 2017.

To that end we did some PCI compliance comparison (given that edgescan is a certified PCI ASV) service in addition to the awesome full stack vulnerability intelligence solution it always has been.

 How to improve security in a dramatic fashion? Whats the biggest quick win to improve your security posture you ask?

 All vulnerabilities are not created equal.
We need to look at vulnerability management in a pragmatic way. Its not possible to be vulnerability-free and 100% secure, but we can aim for removing any issues which may give rise to a breach of client or organisational data. So, lets mitigate the highest risks first and not sweat about the small stuff.
Risk is not linear and reducing vulnerability count does not necessarily translate to significant risk reduction.

If we look at vulnerabilities from a risk-based pragmatic approach the following items should be examined (assuming you wish to keep your estate secure):

APPLICATION LAYER RISK DENSITY
In 2017 we discovered that on average, 27% of all vulnerabilities were associated with web applications and 73% were network vulnerabilities....BUT
The majority of critical and high risk issues were firms situated on the application layer.

So...

  • Network: More noise, more vulnerabilities, less risk.
  • Web/Layer 7: Fewer overall vulnerabilities, higher risk. Most of the weaknesses which could result in a breach are living here.


 This is due to each application being uniquely developed (hosting environments are homogeneous in comparison) and apparent difficulties in managing component version control and patching of third party libraries.

COMPLIANCE AND PCI DSS

Fullstack Cyber Security View:
18% of all vulnerabilities discovered in edgescan had a CVSS v2 score of 4.0 or more.- This is a PCI fail .
Host/Server View:
13% of all vulnerabilities in the network layer had a CVSS v2 score of 4.0 or more. - Also PCI DSS fail
Network/Host View:
32% of ALL vulnerabilities in the web application layer (Layer 7) has a score of 4.0 or more - Also a PCI DSS fail.


CVE LANDSCAPE

 Finally we are still finding a non trivial amount of old vulnerabilities on live Internet facing systems.
People discuss the importance of Zerodays but the root cause of many breaches is exploitation of unpatched systems. Don't worry about Zerodays, focus on patching your current stuff.


In 2017 edgescan found systems without patches for vulnerabilities dating back to 1999.
The most common CVE was from 2004. To see more read the edgescan report here






Comments

Post a Comment

Popular posts from this blog

By -
Image
The HSE Data Breach and the State of Irish Cyber Security Many years ago, shortly after I founded the Irish chapter of OWASP ( http://www.owasp.org ) (in 2007??) we were delivering free application and software development classes to anyone who wanted them. It was a local low key affair but every class we delivered was "sold out". We have 60-80 folks mostly developers willing to spend 4-5 hours on learning the fundamentals of secure application development and testing. I suppose we felt cyber security was an important issue because that's what we did. At the time many folks in business felt cyber security was an overhead or a "tax" and did not give it much time. A few years later (late 2010) when the the foundation of the NCSC (National Cyber Security Centre) was announced, a few of us (local OWASP Ireland leaders) wrote a number of emails to the Irish government offering free cyber security training. As we were working for a non profit (501.3c) charity (OWA...
Read more

Edgescan and Huawei - Cybersecurity - Irish Times Article and Panel Discussion

By -
Image
I recently was interviewed by the Irish times on why is everything getting hacked and how can we change the game.... https://www.irishtimes.com/special-reports/cybersecurity-focus/criminals-have-an-inbuilt-advantage-in-the-great-cyber-arms-race-1.4651078  A recording of the Panel with Andy Purdy, CSO of Huawei North America. https://www.youtube.com/watch?v=cQJ1uSQ4IEk&t=33s Both are decent and worth a listen.
Read more

How Simple can it be.....XSS Prevention....

By -
Cross Site Scripting is sill a very common web vulnerability. Generally it is used to attack clients/users. It can be used for malware upload, botnet hooking, keylogging, a payload delivery system for clickjacking and CSRF attacks and much much more, all for 6 easy payments of $9.99...sorry got carried away there :) But is is easily preventable. You dont even have to know what XSS (type 0, type 1, type 2, DOM, Stored, Reflected) is to prevent it. One pretty simple way to prevent XSS is to use the OWASP ESAPI (Enterprise Security API). A very easy tool to use/invoke. It's also managed and attended to by Chris Schmidt ....A great guy... Regardless of what it does....if there was a mandate to use it on all redisplayed external input a site could become virtually XSS free!! (all for 6 easy payments of......). It's easy to deploy.... 1. Include in JSP (Java version) 2. Invoke in JSP 3. Job done!!! We include it by <%@ page import="org.owasp.esapi.ESAPI...
Read more