Missing Patches, Misconfiguration Top Technical Breach Causes

Less than half of businesses surveyed can patch critical vulnerabilities within 72 hours. Why does the process take so long?

Nearly 60% of data breaches in the past two years can be traced back to a missing operating system patch or application patch, researchers report. Poor patch management can be linked to the high costs of downtime and disruption, both of which are magnified in larger organizations and are poised to escalate as businesses rush to support fully remote staff as COVID-19 spreads.
The stat comes from Automox, where a team polled 560 IT and security pros at companies with 500 to 25,000 employees. They learned 81% had suffered a breach in the past two years. Thirty-six percent of those incidents stemmed from a phishing attack, which was the most common root cause, followed by missing OS patch (30%), missing application patch (28%), OS misconfiguration (27%), insider threat (26%), credential theft (22%), and brute force (17%).
Everyone is aware that phishing attacks are a top root cause for data breaches, says Jay Goodman, strategic product marketing manager with Automox. What we found is there is a surprising amount [of] OS patches, application patches, and misconfiguration mistakes that led to root the cause for data breaches.
This data indicates improved patching processes could strengthen enterprise defense against cybercrime; however, patch management has historically been a nightmare for IT and security teams: 12,174 common vulnerabilities and exposures (CVEs) were
reported
last year, and applying these patches takes time. Less than half of businesses Automox surveyed would be able to patch critical vulnerabilities within 72 hours of their disclosure, and only 20% could patch zero-day flaws within a 24-hour period.
Its a scale issue and its a prioritization issue, says Stephen Boyer, co-founder and CTO at BitSight. Think about all the vulnerabilities coming at you. The key question is which vulnerabilities [to patch] and when.
Patching is pricey, and larger businesses suffer greater losses in disruption and downtime. Boyer refers to a defense contractor as an example: There, he says, it could cost $250,000 to roll out a single patch. Not all fixes are this expensive, but lets say the average hourly wage for a company is $25 per hour, and updating a system disrupts work for 10 minutes per employee. With an employee base of 50,000 people, that amounts to about $208,000 in lost productivity.
Of course, not all patches will cause this much disruption, but you can see how it can add up, he explains. Patching requires IT and security to juggle complexity, scale, and prioritization. Its a very, very difficult problem in practice, Boyer notes, and its not a trivial task for security teams to handle when tens of thousands of vulnerabilities are being disclosed each year.
Its easier for small businesses because they dont have the overhead of the processes associated with patching that larger organizations have to implement, says Goodman. Security teams need to verify a patch works, make sure it doesnt interfere with other systems, and slowly roll it out to a small subset of users to ensure its working as it should be.
Larger organizations are also at a disadvantage because theyre more likely to run older OS versions. When Microsoft ended support for Windows 7 in January, nearly 90% of firms with more than 10,000 employees were still running it on at least one machine. Only 61% of businesses with fewer than 1,000 employees were doing the same, BitSight
reported
at the time.
Costly downtime and disruptions mean even fire drill vulnerabilities dont get patched. Boyer refers to BlueKeep, the Remote Desktop Protocol flaw Microsoft
disclosed
last summer. As of July 2019, about 788,214 systems remain vulnerable to BlueKeep, BitSight found. As of about a week ago, there were still 377,944 systems exposed, Boyer says, citing a new pool of data.
Remote Work Wont Make It Easier
While respondents to Automoxs
survey
say they prioritize patching and hardening their systems, there are several issues that get in the way. Practitioners cite difficulty patching systems belonging to mobile employees and remote offices, inefficient patch testing, lack of visibility into endpoints, and insufficient staffing in both SecOps and IT operations.
Many of todays businesses have begun to support fully remote staff to protect them from the spread of COVID-19. The shift is likely to exacerbate existing patch management challenges. Its a huge problem, says Boyer of the rapid transition. You just exploded the attack surface of an organization. Instead of employees working behind a firewall on corporate Wi-Fi, they are working from home networks. Many dont even have a corporate machine, he points out.
The scale and speed with which it happened is scary, and the environments people are working in now are way different from corporate environments, Boyer continues.
To effectively patch systems in this climate, remote management is needed on every machine. But what if something goes wrong in the middle of an upgrade? What if a user cant log in to an application, or they dont have something installed when they should? If someones software upgrade doesnt go smoothly and interferes with critical software, are they out of luck? Businesses will be forced to decide on how long someone can hold off on a patch, Boyer explains.
Remote employees are falling behind in terms of patching, says Goodman. How is that going to grow over time as organizations face the new work-from-home reality?
Check out
The Edge
, Dark Readings new section for features, threat data, and in-depth perspectives. Todays featured story:
What Should I Do If Someone Is Impersonating My Company in a Phishing Campaign?

Last News
▸ Scan suggests Heartbleed patches may not have been successful. ◂ Discovered: 23/12/2024 Category: security	▸ IoT Devices on Average Have 25 Vulnerabilities ◂ Discovered: 23/12/2024 Category: security	▸ DHS-funded SWAMP scans code for bugs. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Missing Patches, Misconfiguration Top Technical Breach Causes