Vulnerability Disclosures in 2018 So Far Outpacing Previous Years'
Nearly 17% of 10,644 vulnerabilities disclosed so far this year have been critical, according to new report from Risk Based Security.
There appears to be little relief in sight for organizations hoping for some respite from patching. A new report from Risk Based Security released today reveals that the number of vulnerabilities discovered in software products shows no signs of abating.
Between January 1 and June 30 of this year, a total of 10,644 vulnerabilities were published compared to 9,690 in the same period in 2017. The trend so far this year suggests that the total number of disclosed vulnerabilities in 2018 will comfortably exceed the 20,832 vulnerabilities that Risk Based Security published during 2017 — which itself represented a 31% increase over 2016.
About 17% of the reported flaws this year were deemed critical and had a severity rating of between 9.0 and 10.0 on the CVSS rating scale. That number is smaller than the 21.1% of flaws overall that garnered the same rating in Risk Based Security's report for the first half of 2017.
Somewhat expectedly a plurality of 2018 vulnerabilities – 46.3% - were Web-related flaws, and half of all reported vulns were remotely exploitable. Nearly one-third of the vulnerabilities so far this year in Risk Based Security's database have public exploits, but 73 have a documented solution.
A majority of the vulnerabilities are based on processing user or attacker-supplied input, and the software not properly-sanitizing that input, says Brian Martin, vice president of vulnerability intelligence for Risk Based Security. "We classify them as input manipulation issues that impact the integrity of the software," he notes.
Not All in the CVE & NVD
Significantly, Risk Based Security's vulnerability database contained more than 3,275 vulnerabilities that were not published in MITRE's CVE and the National Vulnerability Database (NVD) in the first half of 2018. Of these, more than 23% had a CVSS score between 9.0 and 10.0.
In other words, organizations relying purely on the CVS/NVD vulnerability data would likely not have been aware of more than 750 other critical vulnerabilities that were published elsewhere.
"The biggest takeaway is that the number of vulnerabilities being disclosed continues to rise, and will continue to do so for the foreseeable future," Martin says.
More importantly, the data shows that organizations cannot rely solely on the CVE database for their vulnerability data, he says.
His firm uses over 2,000 sources for its vulnerability data including mail lists such as Bugtraq and Full Disclosure, exploit websites such as ExploitDB and Packetstorm, and vendor resources such as customer forums. Other sources include formal advisories and knowledge base articles, and developer resources such as changelog, bug-tracking systems, and code commits, Martin says.
Risk Based Systems typically aggregates and processes newly disclosed vulnerabilities in less than 24 hours, depending on the disclosure and if additional analysis is needed. For some security vulnerabilities, the vendor discloses at roughly the same time as CVE and for others, it is weeks and even months, ahead of them, he notes.
Not So Fast
While Risk Based Security's statistics might suggest that software is becoming increasingly buggy, the reality appears a little more nuanced. According to Martin, there are likely many reasons why more flaws are being discovered in software products these days despite the heightened awareness and attention being paid to application security.
Among them is the fact that there are a lot more security researchers looking for and reporting security vulnerabilities these days compared to a few years ago. Tools for finding security vulnerabilities have improved as well and have become faster and more reliable than before, too.
And organizations that monitor and aggregate vulnerabilities are also improving their processes and software vendors themselves have become better at disclosing vulnerabilities reported to them, Martin notes.
- Cyber Incident Response Consultant, Italy
- Up to €60,000
Cyber Incident Response Consultant, Italy Up to €60,000 Cyber Incident Response Consultant is needed to join a global consultancy whose cyber business unit are continuing to their investment in the growth of their team. The Cyber Incident Response Consultant role is client facing that will join an award-winning team that deliver varied, interesting and often challenging work to a wide range of prestigious clients. The Cyber Incident Response Consultant MUST have current experience taking a client through the complete IR / triage process and have a blend of both technical and commercial (identifying and developing new business opportunities within a client) Proactive Incident response, forensics and eDiscovery experience is a MUST. The Cyber Incident Response Consultant must be happy to travel. Key attributes should also include; stakeholder engagement, mentoring of team members, a collaborative working style. Technical experience must include; demonstrable experience within an cyber incident response, Forensic, cyber etc. Additional certifications could / should include GIAC certified (Intrusion analyst, incident handler, forensic handler) Any of the following are very desirable also CREST Certified Network Intrusion Analyst (CCNIA) CREST Certified Host Intrusion Analyst (CCHIA) CREST Certified Malware Reverse Engineer (CCMRE) CREST Practitioner Intrusion Analyst (CPIA) Career development and the opportunity to influence, apply today for more information.
- Data Consultant
- Up to £90,000 Base
Data Consultant Location: London Salary: Up to £90,000 basic DD7692 A leading Google Cloud Platform (GCP) Provider who is looking for a Data Consultant, based in London. Experience with GCP or other similar platforms (AWS, AZURE etc), experience with GCP technologies as well as experience with Machine Learning, Data Mining and Data Analytics. The Data Consultant will be responsible for design solutions for customers and providing technical knowledge in customer meetings. Ideally, the Data Consultant will have experience transforming the way companies work by building company-centric solutions on the Google Cloud Platform or similar cloud platforms. Our client is a Premier Google Cloud Partner, offering an exciting opportunity to work with innovative technology whilst giving you the chance to grow and develop your career. You will have the opportunity to benefit from a number of training courses at several Google locations.
- Senior Delivery Consultant Emerging Technologies
Senior Delivery Consultant Emerging Technologies The Senior Delivery Consultant will work on pure retained executive search mandates in the emerging technology sector. The Senior Delivery Consultant will work closely with the practice lead to complete research and deliver the assignment to completion. This is a senior role with both client and candidate contact, although you will not have a fee generation target. A generous commission structure will exist linked to the successful delivery of assignments. Come and work for a business where the client is retained and you can focus 100% of your time and efforts headhunting the best talent out there in the market! Ref: AMSDC Salary: Dependant on Experience Location: Beckenham
- SOC Manager / Threat Hunting Service Lead, Cyber
- £85,000 +
REFCH7713 SOC Manager / Threat Hunting Service Lead, Cyber £85,000 + Bracknell SOC Manager / Threat Hunting service Lead needed- must be commutable to the Reading / Bracknell area. We are looking for a SOC Manager / Threat Hunting Service Lead to aid in building out a new SOC / Threat hunting (IR) service offering. An in-depth technical background is essential, experience across SOC SIEM/ Threat Hunting (IR) tools, processes, techniques, operational is a MUST. The role will include, but not limited to; Establishing the technical process, building operational capability, managing and hiring team, creation of policy/playbooks, fine turning of the go-to-market collateral etc. Apply today for more information or contact me directly on Chris.Holt@dclsearch.com or 07884666351 Cyber Security Jobs, Information Security Jobs, SOC Manager Jobs, SOC Jobs