Researchers Report 20,000 Vulnerabilities, Reinforcing Need for Proactive Cybersecurity Strategy

The number of recorded software vulnerabilities soared to almost 20,000 last year, according to a new report, suggesting a pressing need for organizations to adopt a proactive cybersecurity strategy.

In its “Vulnerability Review 2018,” software vendor Flexera noted that the number of vulnerabilities shot up 14 percent between 2016 and 2017, though the percentage of highly critical flaws stayed relatively flat at 16 percent. The report characterized the majority (55 percent) of these vulnerabilities as remote network flaws, followed by local network vulnerabilities at 32 percent.

Report Highlights the Importance of Proactive Patching

Flexera’s Secunia Research unit drew upon data it gathered from monitoring more than 55,000 applications, operating systems and hardware. The report underscored the importance of keeping up with software patching, noting that there were patches available for 86 percent of vulnerabilities on the day they were disclosed to the public.

Although the thought of zero-day attacks may be keeping chief information security officers (CISOs) up at night, the study showed that out of 19,954 known vulnerabilities, only 14 fell into this category. The authors suggested that it’s more critical to minimize the gap between learning about a flaw and fixing it, thus reducing the window of time during which cybercriminals can steal data.

Flexera isn’t the only firm keeping track of software vulnerabilities. A recent study by global real-time cyberthreat intelligence provider Recorded Future found that Microsoft products, such as Office, Internet Explorer and Edge, accounted for seven of the top 10 vulnerabilities exploited by cybercriminals in 2017.

Time to Update Your Cybersecurity Strategy

Beyond the raw numbers, the Flexera research highlighted organizations’ tendency to implement a reactive cybersecurity strategy. While firms often move quickly to get on top of vulnerabilities once they are disclosed, many don’t examine threat intelligence on an ongoing basis to reduce risks before they emerge as full-blown attacks. A more proactive strategy could help organizations maintain productivity and normal operations while they deal with security risks.

Shane Schick

Writer & Editor

What we can learn from the best collegiate cyber defenders

3 min read - This year marked the 19th season of the National Collegiate Cyber Defense Competition (NCCDC). For those unfamiliar, CCDC is a competition that puts student teams in charge of managing IT for a fictitious company as the network is undergoing a fundamental transformation. This year the challenge involved a common scenario: a merger. Ten finalist teams were tasked with managing IT infrastructure during this migrational period and, as an added bonus, the networks were simultaneously attacked by a group of red…

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

7 min read - This article was made possible thanks to contributions from Aaron Gdanski.IBM X-Force Incident Response and Threat Intelligence teams have investigated several Akira ransomware attacks since this threat actor group emerged in March 2023. This blog will share X-Force’s unique perspective on Akira gained while observing the threat actors behind this ransomware, including commands used to deploy the ransomware, active exploitation of CVE-2023-20269 and analysis of the ransomware binary.The Akira ransomware group has gained notoriety in the current cybersecurity landscape, underscored…

New proposed federal data privacy law suggests big changes

3 min read - After years of work and unsuccessful attempts at legislation, a draft of a federal data privacy law was recently released. The United States House Committee on Energy and Commerce released the American Privacy Rights Act on April 7, 2024. Several issues stood in the way of passing legislation in the past, such as whether states could issue tougher rules and if individuals could sue companies for privacy violations. With the American Privacy Rights Act of 2024, the U.S. government established…

Security Intelligence

{{title}}

{{title}}

{{title}}

Topics

Report Highlights the Importance of Proactive Patching

Time to Update Your Cybersecurity Strategy

More from

What we can learn from the best collegiate cyber defenders

A spotlight on Akira ransomware from X-Force Incident Response and Threat Intelligence

New proposed federal data privacy law suggests big changes

Topic updates