It Takes an Average 38 Days to Patch a Vulnerability

It takes over a month for the average organization to patch its most critical vulnerabilities, according to a new report detecting trends in Web application attacks.

The data comes from tCell, which today released its Q2 2018 "Security Report for In-Production Web Applications." Researchers analyzed more than 316 million security incidents across its customer base and published key findings on the most common types of real-world attacks taking place within in-production Web apps in the Amazon Web Services and Microsoft Azure cloud ecosystems.

TCell published the report for the first time last year, when it noted a high attack-to-breach ratio, explains co-founder and CEO Michael Feiertag. The volume of attempts that attackers go through before landing a successful breach are 100,000 to 1, he says. Web application attacks are noisy because attackers use automation to hunt weak spots within the apps.

"This year we evaluated the data over the last quarter to understand how access to security data from the application has impacted the team's ability to secure their apps," he continues. "We discovered that security teams who have this data gained measurable process improvements for remediation, used the data to improve collaboration with developer and operations peers, and helped prioritize work to gain scale for overstretched teams."

Researchers recognized two primary attacks at play. One was the prevalence of attempted cross-site scripting (XSS) attacks aimed at application users, which were the most common type of incident detected. Most instances of XSS are only attack attempts, they point out. Last year, only one in 1,200 attempts were successful, making it tough to separate breaches from attack attempts.

The second most common was SQL injection, which was leveraged to access sensitive data or run OS commands to gain further access into a target system. Automated threats, fire path traversal, and command injection rounded out the top five most common Web application attacks for Q2.

"We are seeing a bifurcation of attacks," Feiertag says. The majority, by volume, are scanning attacks in which probes target many apps with every possible easy-to-test attack. Researchers also saw a spike in targeted attacks, which hit individual apps with advanced threats going for high-value vulnerabilities: command injection to put malicious code on a server, for example, or compromised credentials to gain administrative access.

"Both appear to be financially motivated but with different approaches to achieve those goals – wide vs. deep," he adds.

TCell's top five most common incidents differ from the most popular attacks as listed by the Open Web Application Security Project (OWASP); those are injection flaws, broken authentication, sensitive data exposure, XML external entities, and broken access control. The reason is that tCell specifically considers attacks and breaches in production that reside in public cloud environments, while OWASP considers a broader set of data, which provides "a different view on the same problem," Feiertag explains.

CVEs: Prevalence and Patching
According to tCell's report, 90% of active applications had a known CVE, tCell says, while 30% had a critical CVE during the second quarter. Experts detected an average of 2,900 orphaned routes or exposed API endpoints per application, which signify an attack surface with no current business function and represent a security "blind spot," they explain in their report.

It took an average of 38 days for an organization to patch a vulnerability, regardless of its severity level, and 34 days for an organization to patch its most critical CVEs. Those stats may be affected by the size of the organization, researchers noted, given how larger businesses take significantly longer to patch vulnerabilities than smaller ones.

The less severe the vulnerability, the longer the time frame. Medium severity vulnerabilities took an average of 39 days to patch; low severity flaws took an average of 54 days. The oldest unpatched CVE took nearly a year – 340 days – to address.

Feiertag says the numbers have gotten better. "We've seen our customers significantly decrease their time to remediate rates," he notes, with teams becoming more aware of the need to roll out patches quickly.

Web App Security: What Companies Are Doing
Forward-looking companies are adopting application security approaches that integrate with DevOps and the cloud, Feiertag says. The technologies enabling this, such as RASP, are newer and still evolving but are an improvement over WAF, AST, and waterfall SDLC processes.

However, he continues, many teams and companies have not embraced this change and continue to fall behind, with their software and infrastructure getting ahead of their security tools and strategies.

"Ironically, those are frequently the companies that spend the most money on security, but the results that they achieve are generally below that of their more flexible and efficient peers," Feiertag says. He advises companies to understand their specific risks – "If you have an app on the Internet, it'll get attacked eventually," he says – and to use the right tools and data to minimize them.

Related Content:

Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early bird rate ends August 31. Click for more info.