Missing Patches, Misconfiguration Top Technical Breach Causes

Nearly 60% of data breaches in the past two years can be traced back to a missing operating system patch or application patch, researchers report. Poor patch management can be linked to the high costs of downtime and disruption, both of which are magnified in larger organizations and are poised to escalate as businesses rush to support fully remote staff as COVID-19 spreads.

The stat comes from Automox, where a team polled 560 IT and security pros at companies with 500 to 25,000 employees. They learned 81% had suffered a breach in the past two years. Thirty-six percent of those incidents stemmed from a phishing attack, which was the most common root cause, followed by missing OS patch (30%), missing application patch (28%), OS misconfiguration (27%), insider threat (26%), credential theft (22%), and brute force (17%).

"Everyone is aware that phishing attacks are a top root cause for data breaches," says Jay Goodman, strategic product marketing manager with Automox. "What we found is there is a surprising amount [of] OS patches, application patches, and misconfiguration mistakes that led to root the cause for data breaches."

This data indicates improved patching processes could strengthen enterprise defense against cybercrime; however, patch management has historically been a nightmare for IT and security teams: 12,174 common vulnerabilities and exposures (CVEs) were reported last year, and applying these patches takes time. Less than half of businesses Automox surveyed would be able to patch critical vulnerabilities within 72 hours of their disclosure, and only 20% could patch zero-day flaws within a 24-hour period.

"It's a scale issue and it's a prioritization issue," says Stephen Boyer, co-founder and CTO at BitSight. "Think about all the vulnerabilities coming at you. The key question is which vulnerabilities [to patch] and when."

Patching is pricey, and larger businesses suffer greater losses in disruption and downtime. Boyer refers to a defense contractor as an example: There, he says, it could cost $250,000 to roll out a single patch. Not all fixes are this expensive, but let's say the average hourly wage for a company is $25 per hour, and updating a system disrupts work for 10 minutes per employee. With an employee base of 50,000 people, that amounts to about $208,000 in lost productivity.

"Of course, not all patches will cause this much disruption, but you can see how it can add up," he explains. Patching requires IT and security to juggle complexity, scale, and prioritization. "It's a very, very difficult problem in practice," Boyer notes, and it's not a trivial task for security teams to handle when tens of thousands of vulnerabilities are being disclosed each year.

"It's easier for small businesses because they don't have the overhead of the processes associated with patching that larger organizations have to implement," says Goodman. Security teams need to verify a patch works, make sure it doesn't interfere with other systems, and slowly roll it out to a small subset of users to ensure it's working as it should be.

Larger organizations are also at a disadvantage because they're more likely to run older OS versions. When Microsoft ended support for Windows 7 in January, nearly 90% of firms with more than 10,000 employees were still running it on at least one machine. Only 61% of businesses with fewer than 1,000 employees were doing the same, BitSight reported at the time.

Costly downtime and disruptions mean even "fire drill" vulnerabilities don't get patched. Boyer refers to BlueKeep, the Remote Desktop Protocol flaw Microsoft disclosed last summer. As of July 2019, about 788,214 systems remain vulnerable to BlueKeep, BitSight found. As of about a week ago, there were still 377,944 systems exposed, Boyer says, citing a new pool of data.

Remote Work Won't Make It Easier
While respondents to Automox's survey say they prioritize patching and hardening their systems, there are several issues that get in the way. Practitioners cite difficulty patching systems belonging to mobile employees and remote offices, inefficient patch testing, lack of visibility into endpoints, and insufficient staffing in both SecOps and IT operations.

Many of today's businesses have begun to support fully remote staff to protect them from the spread of COVID-19. The shift is likely to exacerbate existing patch management challenges. "It's a huge problem," says Boyer of the rapid transition. "You just exploded the attack surface of an organization." Instead of employees working behind a firewall on corporate Wi-Fi, they are working from home networks. Many don't even have a corporate machine, he points out.

"The scale and speed with which it happened is scary, and the environments people are working in now are way different from corporate environments," Boyer continues.

To effectively patch systems in this climate, remote management is needed on every machine. But what if something goes wrong in the middle of an upgrade? What if a user can't log in to an application, or they don't have something installed when they should? If someone's software upgrade doesn't go smoothly and interferes with critical software, are they out of luck? Businesses will be forced to decide on how long someone can hold off on a patch, Boyer explains.

"Remote employees are falling behind in terms of patching," says Goodman. "How is that going to grow over time as organizations face the new work-from-home reality?"

Check out The Edge, Dark Reading's new section for features, threat data, and in-depth perspectives. Today's featured story: "What Should I Do If Someone Is Impersonating My Company in a Phishing Campaign?"