Researchers Report 20,000 Vulnerabilities, Reinforcing Need for Proactive Cybersecurity Strategy

The number of recorded software vulnerabilities soared to almost 20,000 last year, according to a new report, suggesting a pressing need for organizations to adopt a proactive cybersecurity strategy.

In its “Vulnerability Review 2018,” software vendor Flexera noted that the number of vulnerabilities shot up 14 percent between 2016 and 2017, though the percentage of highly critical flaws stayed relatively flat at 16 percent. The report characterized the majority (55 percent) of these vulnerabilities as remote network flaws, followed by local network vulnerabilities at 32 percent.

Report Highlights the Importance of Proactive Patching

Flexera’s Secunia Research unit drew upon data it gathered from monitoring more than 55,000 applications, operating systems and hardware. The report underscored the importance of keeping up with software patching, noting that there were patches available for 86 percent of vulnerabilities on the day they were disclosed to the public.

Although the thought of zero-day attacks may be keeping chief information security officers (CISOs) up at night, the study showed that out of 19,954 known vulnerabilities, only 14 fell into this category. The authors suggested that it’s more critical to minimize the gap between learning about a flaw and fixing it, thus reducing the window of time during which cybercriminals can steal data.

Flexera isn’t the only firm keeping track of software vulnerabilities. A recent study by global real-time cyberthreat intelligence provider Recorded Future found that Microsoft products, such as Office, Internet Explorer and Edge, accounted for seven of the top 10 vulnerabilities exploited by cybercriminals in 2017.

Time to Update Your Cybersecurity Strategy

Beyond the raw numbers, the Flexera research highlighted organizations’ tendency to implement a reactive cybersecurity strategy. While firms often move quickly to get on top of vulnerabilities once they are disclosed, many don’t examine threat intelligence on an ongoing basis to reduce risks before they emerge as full-blown attacks. A more proactive strategy could help organizations maintain productivity and normal operations while they deal with security risks.

Shane Schick

Writer & Editor

When ransomware kills: Attacks on healthcare facilities

4 min read - As ransomware attacks continue to escalate, their toll is often measured in data loss and financial strain. But what about the loss of human life? Nowhere is the ransomware threat more acute than in the healthcare sector, where patients’ lives are literally on the line.Since 2015, there has been a staggering increase in ransomware attacks on healthcare facilities. And the impacts are severe: Diverted emergency services, delayed critical treatments and even fatalities. Meanwhile, the pledge some ransomware groups made during…

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

6 min read - With cloud infrastructure and, more recently, artificial intelligence (AI) systems becoming prime targets for attackers, security leaders are laser-focused on defending these high-profile areas. They’re right to do so, too, as cyber criminals turn to new and emerging technologies to launch and scale ever more sophisticated attacks.However, this heightened attention to emerging threats makes it easy to overlook traditional attack vectors, such as human-driven social engineering and vulnerabilities in physical security.As adversaries exploit an ever-wider range of potential entry points…

4 trends in software supply chain security

4 min read - Some of the biggest and most infamous cyberattacks of the past decade were caused by a security breakdown in the software supply chain. SolarWinds was probably the most well-known, but it was not alone. Incidents against companies like Equifax and tools like MOVEit also wreaked havoc for organizations and customers whose sensitive information was compromised.Expect to see more software supply chain attacks moving forward. According to ReversingLabs' The State of Software Supply Chain Security 2024 study, attacks against the software…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Report Highlights the Importance of Proactive Patching

Time to Update Your Cybersecurity Strategy

More from

When ransomware kills: Attacks on healthcare facilities

AI and cloud vulnerabilities aren’t the only threats facing CISOs today

4 trends in software supply chain security

Topic updates