New critical software vulnerabilities are discovered every month, but its older vulnerabilities in legacy systems that continue to plague IT departments and cybersecurity professionals, according to new research from cybersecurity firm F-Secure.
The report, Attack Landscape Update, dishes on trending cybersecurity threats, including ransomware, malware, phishing and more, but the most alarming information in the report details just how important it is to maintain regularly updated software.
The firm’s vulnerability management team identified 11,950 different security issues in organizational networks in the second half of 2020, which covered nearly 44,000 different CVEs. Out of the nearly 12,000 security issues, 100 accounted for over 50% of detections.
However, the report showed an alarming trend: 61% of all issues were at least five years old, with 9% dating back to 1997, even predating the CVE system.
Read Next: CISA Adds 95 New Bugs To Database Of Known Exploited Vulnerabilities
When categorized according to the year in which they were first published, the greatest share (15%) were published in 2016, followed by 2020 (14%) AND 2019 (10%).
F-Secure’s report found that the most prevalent vulnerabilities were encryption-related issues from 2016 and previous years, including CVE-2016-2183—an SSL supporting weak ciphers bug that enables the SWEET32 attack. Other similar SSL protocol encryption-related bugs from 2015, 2013 and 2011 were also found to be prevalent.
The report highlighted CVE-2014-3566, another SSL bug discovered by Google. Engineers at the time recommended disabling SSL 3.0 and replacing it with TLS, noting that SSL 3.0 was 18 years old. However, SSL, now 24 years old, is still popular, the report found.
The prevalence of these issues across organizations highlights the problem of legacy infrastructure and the struggles of IT departments with keeping legacy systems secure, the company said in the report.
“Furthermore, the situation serves as a reminder that security is a continuous process: Although an effort was initially made to secure the systems by enabling encryption, the encryption is no longer effective, leaving the systems insecure,” the report said.
Leave a Reply