A new report from the Ponemon Institute and ServiceNow titled, Today’s State of Vulnerability Response: Patch Work Demands Attention, highlights the need for better patch management practices. According to the study, in the past two years, 48% of companies have experienced a data breach.
Even more troubling than the number of companies that have experienced a breach is the reason why. Per the report, “Fully 57% of respondents who reported a breach said that they were breached due to a vulnerability for which a patch was available but not applied. 34% say they actually knew they were vulnerable before the breach occurred.”
If this type of behavior continues, we’ll see even more companies making headlines. Per the report, respondents have seen a 15% increase in cyberattack volumes over the last 12 months, and a 23% increase in cyberattack severity over the last 12 months. More than half have also seen an increase in the speed of attacks. The time between a patch release and an attack has sped up by 29% in the last two years.
The report highlights two factors that showed up between companies that haven’t been breached and those that have. “Companies that avoided breaches rated their ability to patch vulnerabilities in a timely manner 41% higher than those that had been breached, and they rated their ability to detect vulnerabilities 19% higher. Patching is the most significant characteristic of companies that were not breached in the last two years.”
As we’ve mentioned before, you can’t patch what you can’t see. Visibility of your infrastructure is critical to reduce this attack vector. Simply knowing what patches you need can reduce your risk of being breached by 20%.
Beyond visibility into their patch status, the other limitation respondents face is a manual patching process. 61% admit that manual processes put them at a disadvantage, and 55% note that they spend more time dealing with internal processes than managing the vulnerabilities.
More than 12 days are lost coordinating between teams to get patches applied. Reasons include:
- 73% have no common view of assets and applications across security and IT
- 57% admit that patches slip through the cracks due to emails and spreadsheets used to manage the process
- 62% have no easy way to track whether vulnerabilities of being patched in a timely manner
- 65% say they find it difficult to prioritize what needs to be patched first
The study also mentions a ‘patching paradox’, whereby the idea of hiring more people will improve security hygiene. Though in reality it doesn’t. 64% of companies are planning to hire more dedicated people to handle vulnerabilities, accounting for a 50% increase in headcount.
“While security teams plan to hire more staffing resources for vulnerability response – and may need to do so—they won’t improve their security posture if they don’t fix broken patching processes. The study shows that firms struggle with patching because they use manual processes and can’t prioritize what needs to be patched first.”
All of this points to cloud-based automation as the answer. Automox provides you with visibility of your infrastructure, including your remote endpoints. And displays the current patch status of every endpoint with patch severity ratings so you can prioritize which patches to deploy first. Finally Automox automates your patch remediation so you don’t lose valuable time between patch release and application.
To learn more, visit us online. Or to try Automox for yourself risk free, sign up for our free 15 day trial. You’ll get full platform access, no endpoint limit, and no credit card is required to sign up.