There May Be a Ceiling on Vulnerability Remediation

Most organizations are doing all they can to keep up with the release of vulnerabilities, new research shows.

Security has no shortage of metrics — everything from the number of vulnerabilities and attacks to the number of bytes per second in a denial-of-service attack. Now a new report focuses on how long it takes organizations to remediate vulnerabilities in their systems — and just how many of the vulnerabilities they face theyre actually able to fix.
The report,
Prioritization to Prediction Volume 3: Winning the Remediation Race
, by Kenna Security and the Cyentia Institute, contains both discouraging and surprising findings.
Among the discouraging findings are statistics that show companies have the capacity to close only about 10% all the vulnerabilities on their networks. This percentage doesnt change much by company size.
Whether it was a small business that had, on average, 10 to 100 open vulnerabilities at any given time, they had roughly the same percentage of vulnerabilities they could remediate as the large enterprises, where they had 10 million-plus open vulnerabilities per month, says Ed Bellis, CTO and co-founder of Kenna Security,
In other words, Bellis said, the capacity to remediate seems to increase at approximately the same rate as the need to remediate. The size thing that tipped us off that there might be some upper threshold on what organizations were able to to fix in a given time frame, says Wade Baker, partner and co-founder of the Cyentia Institute.,
The time frame for remediating vulnerabilities differs depending on the softwares publisher. Microsoft and Google tend to have software with vulnerabilities remediated most quickly by organizations both large and small, Bellis says. The software with the longest remediation time? Legacy software and code developed in-house.
There are also dramatic differences in time to remediate between companies in different industries. Investment, transportation, and oil/gas/energy led the way in the shortest time to close 75% of exploited vulnerabilities, hitting that mark in as few as 112 days. Healthcare, insurance, and retail/trade took the longest for remediation, needing as much as 447 days to hit the milestone.
Data suggests that some organizations are able to do better than the averages — in some cases, remediating more vulnerabilities than were discovered and actually getting ahead of the problem. What the researchers dont yet know is precisely what those high-performing companies are doing that is different. That, they say, is the subject of the next volume of their research.
Related Content:
The 12 Worst Serverless Security Risks
4 Ways At-Work Apps Are Vulnerable to Attack
Bounty Hunters Find 100K+ Bugs Under HackerOne Program in 2018
More Than 22,000 Vulns Were Disclosed in 2018, 27% Without Fixes

Join Dark Reading LIVE for two cybersecurity summits at Interop 2019. Learn from the industrys most knowledgeable IT security experts. Check out the
Interop agenda
here.

Last News
▸ Criminal Possession of Government-Grade Stealth Malware ◂ Discovered: 23/12/2024 Category: security	▸ Senate wants changes to cybercrime law. ◂ Discovered: 23/12/2024 Category: security	▸ Car Sector Speeds Up In Security. ◂ Discovered: 23/12/2024 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
There May Be a Ceiling on Vulnerability Remediation