Why organizations are slow to patch even high-profile vulnerabilities

Image: iStock/weerapatkiatdumrong

One of the astir communal ways cybercriminals deed an enactment is by exploiting a known information vulnerability. For that reason, regularly patching your bundle and different products is simply a captious mode to support yourself from cyberattack.

But galore organizations neglect to support up with the due patching, frankincense exposing themselves to large risk. A study released Wednesday by cybersecurity steadfast Trustwave looks astatine wherefore information flaws often spell unpatched and however organizations tin beef up their spot management.

SEE: Incident effect policy (TechRepublic Premium)

For its 2021 Trustwave SpiderLabs Telemetry Report, Trustwave examined high-profile vulnerabilities from the past year. The study recovered that contempt the precocious severity of immoderate of the information flaws that popped up, much than 50% of the servers were unprotected weeks and adjacent months aft an update had been released.

Number of vulnerabilities published by the National Vulnerability Database from 2011-2021 (as of September 1, 2021).

Image: Trustwave

There are a fewer reasons wherefore information flaws often spell unpatched, according to Trustwave.

First, patching a strategy is not ever arsenic elemental arsenic conscionable installing an update. Some systems are highly analyzable and ngo critical. As such, they whitethorn necessitate respective levels of investigating and support from antithetic teams to marque definite that a fixed spot won't make much problems than it solves.

Second, not each organizations person the unit oregon unit disposable to absorption exclusively connected spot management. Some simply don't person the fund to acceptable up a dedicated team, which means definite staffers person to juggle aggregate roles and tasks.

Third, immoderate organizations deficiency the close process oregon strategy for afloat testing, installing and deploying information patches.

Adding to the risk, galore older oregon outdated applications and services are accessible from the nationalist internet. Savvy cybercriminals who scan for known vulnerabilities tin easy compromise an unpatched and unprotected assets without the enactment knowing astir it.

SEE: Patch absorption policy (TechRepublic Premium)

To assistance organizations get a amended grip connected their spot management, Trustwave offers the pursuing 4 recommendations.

1. Assign an idiosyncratic oregon a squad to plan a information programme that covers hazard absorption and policy. Your champion stake is to enlist idiosyncratic already connected unit with the indispensable cognition and skills to grip this. If you can't find the close idiosyncratic oregon can't give idiosyncratic to this task, look for an outer nonrecreational who volition assistance interior IT oregon information radical until they tin yet instrumentality over.
2. Provide grooming to each employees beyond those successful IT who negociate captious systems. Despite the advent of artificial intelligence, definite captious information flaws request quality interaction. Educate employees with regular information grooming and supply the required enactment material. Ensure that everyone is pursuing the close information policies and guidelines and marque definite they recognize the value of due security.
3. Don't hide astir older oregon outdated systems arsenic these are often the ones astir easy attacked. Ask the proprietor of each strategy to entree its existent presumption and devise a spot absorption program by moving with the information team.
4. Implement an effectual incidental effect plan. Though you privation to debar being victimized, you request a program successful spot successful the lawsuit you are compromised. This benignant of program should trim the harm that a cyberattack inflicts connected your organization.

Also see

• Security consciousness and grooming policy (TechRepublic Premium)
• Risk absorption policy (TechRepublic Premium)
• Checklist: Securing integer information (TechRepublic Premium)
• The apical keywords utilized successful phishing email taxable lines (TechRepublic)
• Security threats connected the horizon: What IT pro's request to cognize (free PDF) (TechRepublic)
• How to go a cybersecurity pro: A cheat sheet (TechRepublic)
• Cybersecurity and cyberwar: More must-read coverage (TechRepublic connected Flipboard)