Security Threat Landscape Still Plagued by Known Issues, Says HP

News provided by

HP

09 Apr, 2015, 17:01 IST

BANGALORE, April 9, 2015 /PRNewswire/ --

Top 10 Vulnerabilities Exploited in 2014 Took Advantage of Known Weaknesses in Systems Implemented Years or Even Decades Ago

HP today published the 2015 edition of its annual Cyber Risk Report, providing in-depth threat research and analysis around the most pressing security issues plaguing the enterprise during the previous year and indicating likely trends for 2015.

Authored by HP Security Research, the report examines the data indicating the most prevalent vulnerabilities that leave organizations open to security risks. This year's report reveals that well-known issues and misconfigurations contributed to the most formidable threats in 2014.

"Many of the biggest security risks are issues we've known about for decades, leaving organizations unnecessarily exposed," said Jyoti Prakash, Country Director, India and SAARC countries, HP Enterprise Security Products (ESP). "We can't lose sight of defending against these known vulnerabilities by entrusting security to the next silver bullet technology; rather, organizations must employ fundamental security tactics to address known vulnerabilities and in turn, eliminate significant amounts of risk." 

Highlights and key findings

  • 44 percent of known breaches came from vulnerabilities that are 2-4 years old. Attackers continue to leverage well-known techniques to successfully compromise systems and networks. Every one of the top ten vulnerabilities exploited in 2014 took advantage of code written years or even decades ago.
  • Server misconfigurations were the number one vulnerability. Over and above vulnerabilities such as privacy and cookie security issues, server misconfigurations dominated the list of security concerns in 2014, providing adversaries unnecessary access to files that leave an organization susceptible to an attack.
  • Additional avenues of attack were introduced via connected devices. In addition to security issues presented via Internet of Things (IoT) devices, 2014 also saw an increase in the level of mobile malware detected. As the computing ecosystem continues to expand, unless enterprises take security into consideration, attackers will continue to find more points of entry.
  • The primary causes of commonly exploited software vulnerabilities are defects, bugs, and logic flaws. Most vulnerabilities stem from a relatively small number of common software programming errors. Old and new vulnerabilities in software are swiftly exploited by attackers.

Key recommendations

  • A comprehensive and timely patching strategy should be employed by network defenders to ensure systems are up-to-date with the latest security protections to reduce the likelihood of these attacks succeeding.
  • Regular penetration testing and verification of configurations by internal and external entities can identify configuration errors before attackers exploit them.
  • Mitigate risk being introduced to a network prior to the adoption of new technologies. With emerging technologies like Internet of Things (IoT), it is imperative for organizations to protect against potential security vulnerabilities by understanding new avenues of attack before they are exploited.
  • Collaboration and threat intelligence sharing is key to cooperatively addressing threats across the security industry. This enables organizations to gain insight into adversarial tactics, allowing for more proactive defense, strengthened protection offered in security solutions, and an overall safer environment.
  • Complementary protection strategy should be adopted with a continuous "assume-breach" mentality. There is no silver bullet solution, and defenders should implement a complementary, layered set of security tactics to ensure the best defense.

Related videos

Methodology

The HP Cyber Risk Report is published annually by HP Security Research, leveraging a number of internal and external sources to identify, research and analyze the findings, including the HP Zero Day Initiative, HP Fortify on Demand security assessments, HP Software Security Research and ReversingLabs. Additional information on the methodology can be found in the full report.

HP enables organizations to take a proactive approach to security, disrupting the life cycle of an attack through prevention and real-time threat detection. With market-leading products, services and innovative research, HP Enterprise Security enables organizations to integrate information correlation, application analysis and network-level defense. Additional information about HP Enterprise Security can be found at www.hp.com/go/esp.  

Join HP Software on LinkedIn and follow @HPSoftware on Twitter. To learn more about HP Enterprise Security Products on Twitter, please follow @HPsecurity and join HP Enterprise Security on LinkedIn.

About HP

HP creates new possibilities for technology to have a meaningful impact on people, businesses, governments and society. With the broadest technology portfolio spanning printing, personal systems, software, services and IT infrastructure, HP delivers solutions for customers' most complex challenges in every region of the world. More information about HP (NYSE: HPQ) is available at http://www.hp.com.

© 2015 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty. HP shall not be liable for technical or editorial errors or omissions contained herein.

Media Contact:

Reena Rajan
[email protected] 
+91-9611546655
Practice Strategic Communications India Pvt Ltd