Unpatched Applications Are #1 Cyber Security Risk

Unpatched client software and vulnerable Internet-facing web sites are the most serious cyber security risks for business. Lesser threats include operating system holes and a rising number of zero-day vulnerabilities, according to a new study.

A leading security education organisation, the SANS Institute, has released a new report describing “The 2009 Top Cyber Security Risks.” It may be read for free (no registration required). Here are its key findings, quoted from the executive summary:

1. Priority One: Client-side software that remains unpatched.
2. Priority Two: Internet-facing web sites that are vulnerable.
3. Operating systems continue to have fewer remotely-exploitable vulnerabilities that lead to massive Internet worms.
4. Rising numbers of zero-day vulnerabilities

Throughout the developed world, governments, defense industries, and companies in finance, power, and telecommunications are increasingly targeted by overlapping surges of cyber attacks from criminals and nation-states seeking economic or military advantage. The number of attacks is now so large and their sophistication so great, that many organizations are having trouble determining which new threats and vulnerabilities pose the greatest risk and how resources should be allocated to ensure that the most probable and damaging attacks are dealt with first.

This report uses current data - covering March 2009 to August 2009 - from appliances and software in thousands of targeted organizations to provide a reliable portrait of the attacks being launched and the vulnerabilities they exploit. The report’s purpose is to document existing and emerging threats that pose significant risk to networks and the critical information that is generated, processed, transmitted, and stored on those networks.

The report was compiled by Rohit Dhamankar, Mike Dausin, Marc Eisenbarth and James King of TippingPoint with assistance from Wolfgang Kandek of Qualys, Johannes Ullrich of the Internet Storm Center, and Ed Skoudis and Rob Lee of the SANS Institute faculty.