Nearly One-Fifth Of Enterprise Operating Systems Not Fully Patched

Less than half of organizations run malicious code execution prevention tools, Rapid7 survey finds

One in five IT professionals say they either have not fully patched their organizations endpoint operating systems -- or they arent sure whether the machines are up-to-date.
A fully patched operating system is the minimum bar for any organization, says Matt Hathaway, senior product manager with Rapid7, which today released results of a survey of 600 IT pros on their enterprises endpoint security practices. Some 83 percent say their endpoint OSes are fully patched.
Seventeen percent [with unpatched OSes] is unsettling as we really consider patching your OS to be the minimum bar for an organizations patching process, Hathaway says. Our assumption is that this can be explained by the challenge of getting broad organizational buy-in for a consistent patching process and a disconnect between the security and IT teams. In some cases, availability is prioritized over patching: for example in the healthcare sector, where treatment is 24/7.
Another red flag from the survey: Fifty-four percent dont or dont know whether they run code execution prevention tools on their machines (think Microsofts Enhanced Mitigation Experience Toolkit). Of that group, 30 percent dont run these tools, and 24 percent dont know if they do.
Even though Microsoft regularly mentions EMET in its security blog, security pros still dont seem to be in the know much about it or its benefits, Hathaway says. Additionally, a lot of our customers have stated that they never bothered implementing [EMET] 3.5 tech preview or the 4.0 beta because they were waiting for a final release. So the long lull may very well explain why our survey results show that EMET is not broadly used only a few months after the 4.0 final release.
The good news is that 96 percent of organizations run antivirus on their endpoints, and 90 percent say their email systems are configured to block suspicious attachments. That means a large number of businesses are employing tools to stop malware from hitting their endpoints, Hathaway says.
Around 16 percent dont require their users to select complex passwords that expire at regular intervals, and 2 percent dont know whether their organizations have this policy. The fact that only 81 percent of respondents enforce complex, expiring passwords makes us question whether the industry debate over the effectiveness of passwords is being misconstrued to mean they are a waste of time, Rapid7s Hathaway says.
The full Rapid7 endpoint security survey is available
here
(PDF) for download.
Have a comment on this story? Please click Add Your Comment below. If youd like to contact
Dark Readings
editors directly,
send us a message
.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
Nearly One-Fifth Of Enterprise Operating Systems Not Fully Patched