Windows 10 Critical Vulnerability Reports Grew 64% in 2017

The number of critical vulnerabilities reported for Windows 10 increased 64% between 2016 and 2017. In total, 587 vulnerabilities were reported across Windows Vista, Windows 7, Windows 8.1/RT 8.1, and Windows 10 over the course of last year.

Researchers at Avecto analyzed data issued by Microsoft via the Security Update Guide throughout 2017. The guide focuses on security vulnerabilities affecting Microsoft products and services. They compiled the data into a yearlong overview to see if vulnerabilities increased.

Overall, they learned the number of reported Microsoft vulnerabilities increased 111% between 2013 and 2017. There has been a 54% increase in Critical Microsoft vulnerabilities reported since 2016, and a 60% increase over the 2013-2017 timeframe.

"I think it's the standard pattern for new operating systems," says Peter Firstbrook, vice president at Gartner, of the increase in reported Windows vulnerabilities. "Bugs generally get discovered as new operating systems launch and get popular."

To his point, the increase in flaws doesn't mean Microsoft's technology is less secure, analysts report. There are several factors at play here, including the growth of the Windows operating system, increasing complexity of services, data leaks, and a larger pool of security researchers.

"The pervasiveness of Windows, of technology means more [vulnerabilities] get identified," says Avecto COO Andrew Avanassian. There are more interconnected devices and shorter time to market, both of which increase the chance that bugs will be discovered. The problem isn't that Windows is less secure, it's that more machines are being used and attacked.

Microsoft's technology has steadily grown more complex, increasing the likelihood that vulnerabilities will evade detection, says Jeff Pollard, principal analyst serving security and risk professionals at Forrester. The company's security development lifecycle (SDL), has improved software security, but flaws in old and new software still slip through the cracks.

Avecto's research isn't limited to the Windows OS alone. There was an 89% increase in Office vulnerabilities between 2013-2017, during which Critical vulns in Microsoft browsers went up 46%.

"The downside to vulnerability discovery is you don't know when that code was written," he points out. "This could have been code written for Office 2005, or 2013, that was carried forward and we just discovered in 2017 … part of what we don't know is how much might be carried forward from prior architecture and prior processes."

Pollard also emphasizes the idea that external events have had a particular impact on reported Windows vulnerabilities. In particular, activity from the Shadow Brokers and the Vault 7 data leak led to the disclosure of many previously unknown vulnerabilities.

"Whenever you have a new vulnerability discovered or a new type of vulnerability, what you find is more stuff pops up around it," he says. Security researchers add a "follow-on" effect when they use these events as starting points to hunt for more bugs. Overall, he says, businesses are becoming more diligent about penetration testing and application testing.

Compliance dictates breaches and vulnerabilities should be acknowledged faster, and there are more organizations and volunteers identifying them.

"The increase in bounties has helped increase disclosure and patches before malware discovers them," says Firstbrook. "Continuous updates with Windows 10 will help patch faster by removing patching delays."

Patches, Admin Rights, and Mitigating Risk

"The biggest takeaway is the sheer number and volume of critical vulnerabilities that could be mitigated by the removal of administrative rights," says Avanessian.

Researchers dug into the data to see which vulnerabilities could be mitigated by removing administrative rights. Their report states 80% of Critical vulnerabilities reported in 2017 could have been mitigated if admin privileges were taken away.

"In security we tend to put an alarm on our house to stop intruders but leave the front door wide open," he adds. "Many organizations could be in a better, more secure place if they did this simple thing."

Pollard agrees that removing administrative rights is one of the best things that could prevent problems, but it does penalize users and interrupts workflow. "You need to know which employees don't have administrative rights and which employees do," he points out.

He points to patch management as a key step to take in mitigating risk. When considering the range of vulnerabilities reported, it's important to consider how many patches need to be deployed to mitigate them. In many cases, a single patch will address multiple issues.

"We need better code quality, we need to make sure the trend doesn't continue … but at the same time, it's not like it was a massive issue to patch all of them." However, he acknowledges patch management can be complicated for many organizations and they may not be able to deploy patches if workloads, applications, and infrastructure get in the way.

Other steps businesses can take include application whitelisting, or having a catalogue of software that can run and another catalogue of software that cannot. Multi-factor authentication is also important.

Related Content:

Black Hat Asia returns to Singapore with hands-on technical Trainings, cutting-edge Briefings, Arsenal open-source tool demonstrations, top-tier solutions and service providers in the Business Hall. Click for information on the conference and to register.