Gotta Patch 'Em All? Not Necessarily, Experts Say

Modern security teams face a daunting task in keeping up with a growing amount of vulnerabilities. While they may not be able to patch all the flaws in their environments, they can cut down on risk by prioritizing high-risk vulnerabilities that are most likely to be exploited.

The volume of published common vulnerabilities and exposures (CVEs) has dramatically increased over the past 20 years, said Benjamin Edwards, senior data scientist with the Cyentia Institute, during the RSA Conference panel "Measuring Vulnerability Remediation Strategies with Real-World Data." Between 1999 and 2004, an average of 1,300 vulnerabilities were published per year. That number increased to 6,100 per year from 2005 to 2016 and then jumped to 18,000 per year for 2017 to 2020, he explained.

"Recently the number of vulnerabilities has increased quite a bit because we have expanded the number of people who can report and categorize CVEs," Edwards continued. Right now, there are more than 130,000 published vulnerabilities that can potentially affect organizations.

It's an overwhelming number denoting a common enterprise problem. Any given business, regardless of size, can patch one in 10 vulnerabilities each month, said Edwards. The data comes from "Prioritization to Prediction, Volume 4: Measuring What Matters in Remediation," a report recently published by the Cyentia Institute and Kenna Security based on a survey of about 100 organizations.

Forty percent of vulnerabilities in enterprise networks are still open today, researchers found. The median time to remediation is 100 days, and 25% of flaws remain open longer than a year. But, as Edwards pointed out, some vulnerabilities are more dangerous than others. There are flaws that affect millions of assets and those that affect hundreds, those that are easy to exploit and those that are difficult, he says. "Can you fix everything? Nope, not even close," Edwards said.

The next question becomes, "Can I remediate vulnerabilities before exploitation?" said Wade Baker, Cyentia Institute partner and co-founder. Chances are you won't patch vulnerabilities before they are weaponized, but you may be able to remediate them before an attacker uses them against you.

"About when a CVE is published, if it's exploited, it happens quickly," Baker continued, noting that zero-days and proof-of-concepts may happen before a flaw is disclosed. "The publication of a vulnerability is a trigger for exploitation, in many cases." Cyentia Institute researchers found 23% of vulnerabilities with published CVEs have associated exploit code.

Exploitation unfolds gradually. The timeline appears like a plateau in which activity initially spikes and then extends for nearly two-and-a-half years after the first exploit, he added. After about three years of activity, the likelihood of that vulnerability being exploited in the wild drops off.

What to Consider in A Remediation Program
The key to effective vulnerability management is knowing which flaws you should prioritize patching. You may not have the capacity to patch everything, but you do have the ability to learn which vulnerabilities are being exploited in the wild and which are in your environment. The research data shows one-third of published CVEs are observed in enterprise environments.

Remediation takes time. According to the research, 40% of vulnerabilities are remediated within the first month and half within the first two months. Nearly one-quarter of vulnerabilities are still open after a year.

The flaws to prioritize are those that have been both observed in enterprise environments and exploited in the wild, which applied to only 5% of all CVEs, researchers found. The "vast majority" (69%) of vulnerabilities never appear in a customer environment, Edwards said. More than half (54%) are never exploited in the wild or seen in enterprise environments. If attackers have not seen a flaw and nobody is using it, it's less of a concern to security teams.

Two in three organizations successfully remediate high-risk vulnerabilities, with 51% reducing the number of high-risk flaws in their environments and 17% maintaining the same level. Those paying down vulnerability debt are doing so with improved focus and execution, Baker said, pointing to four metrics firms can use to measure better or worse remediation performance:

"There is statistically significant evidence that if you try to apply risk-based vulnerability management principles across large portions of your environment, you will fix vulnerabilities faster," Baker said. Researchers also found a simpler remediation process yielded better coverage, whereas more complex processes led to less coverage but slightly better velocity. Programs with adequate budgets fared better than those that lacked enough funds, he added.

The structure of vulnerability management programs made a difference. Time to remediate was about a month-and-a-half shorter among firms that place responsibilities for finding and fixing flaws in separate organizations. This separation of duties also led to higher capacity for remediation, meaning these businesses are less likely to fall behind. Researchers hypothesized having separate teams identify and remediate flaws indicates more resources and maturity.

Researchers also found 40% believed their vulnerability management programs were average, 36% considered them above average, 14% said they were below average, and 8% said they were in the top 10%. "People who think they're above average tend to be above average," Edwards said. "I was surprised at how well people knew their own programs."

Related Content:

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "With New SOL4Ce Lab, Purdue U. and DoE Set Sights on National Security."