Most organizations are doing all they can to keep up with the release of vulnerabilities, new research shows.
Security has no shortage of metrics — everything from the number of vulnerabilities and attacks to the number of bytes per second in a denial-of-service attack. Now a new report focuses on how long it takes organizations to remediate vulnerabilities in their systems — and just how many of the vulnerabilities they face they’re actually able to fix.
The report, “Prioritization to Prediction Volume 3: Winning the Remediation Race,” by Kenna Security and the Cyentia Institute, contains both discouraging and surprising findings.
Among the discouraging findings are statistics that show companies have the capacity to close only about 10% all the vulnerabilities on their networks. This percentage doesn’t change much by company size.
“Whether it was a small business that had, on average, 10 to 100 open vulnerabilities at any given time, they had roughly the same percentage of vulnerabilities they could remediate as the large enterprises, where they had 10 million-plus open vulnerabilities per month,” says Ed Bellis, CTO and co-founder of Kenna Security,
In other words, Bellis said, the capacity to remediate seems to increase at approximately the same rate as the need to remediate. “The size thing that tipped us off that there might be some upper threshold on what organizations were able to to fix in a given time frame,” says Wade Baker, partner and co-founder of the Cyentia Institute.,
The time frame for remediating vulnerabilities differs depending on the software’s publisher. Microsoft and Google tend to have software with vulnerabilities remediated most quickly by organizations both large and small, Bellis says. The software with the longest remediation time? Legacy software and code developed in-house.
There are also dramatic differences in time to remediate between companies in different industries. Investment, transportation, and oil/gas/energy …
Author: Curtis Franklin Jr. Senior Editor at Dark Reading