Cybersecurity Gaps in Scanning and Patching Vulnerabilities in Software | SPONSORED
Current strategies of scanning for and patching vulnerabilities in software leave a huge and highly-exploitable security gap.
Recent research by RunSafe Security partners show that current strategies of scanning for and patching vulnerabilities in software leave a huge and highly-exploitable security gap. When measured against NIST CVEs (Common Vulnerability Enumerations from the National Vulnerability Database), the researchers found that:
- Memory vulnerabilities are the most frequent CVEs reported in the database, making up 40% of the total, and are ranked as the #1 software weakness in MITRE’s current CVE rankings.
- 59% of these memory CVEs have exploits available.
- They produce the highest CVSS consequence scores, in the 7.2 to 9.8 out of 10.0 (the High and Critical ranges), in NIST’s Common Vulnerability Scoring System. In layman’s terms these are the vulnerabilities that, if exploited, can cause the most damage to an organization.
- Only 2.5% (15 of 592) of all Linux CVEs are currently detected by scanning tools, leaving a massive 97.5% security gap.
Cybersecurity for Scanning and Patching
Does this mean scanning and patching are no longer relevant? Obviously they are – they are essential foundation elements for effective cyber security and hygiene.
What it does mean is that other solutions are required to fill the gap, to mitigate cybersecurity risks and vulnerabilities before they are detected, reported, or patched. RunSafe calls this category “software immunization,” by which code can be inoculated against vulnerabilities before deployment. We believe this “third leg of the stool” is an essential new approach that can increase software security by a full order of magnitude, and in many specific use cases completely eliminate the most dangerous weakness in software today, memory-based vulnerabilities.
According to Thomas Scanlon at Carnegie Mellon’s Software Engineering Institute, “84% of software breaches exploit vulnerabilities at the application layer”. This has driven an entire domain of application security testing tools and techniques.
Read the full post from RunSafe Security to learn more about keeping your software secure.
Data Retention for Long-Term IIoT Monitoring Using Time Series Databases
Traditional industries have evolved by implementing many Industrial IoT practices, where we can get data from mechanical devices and sensors. Such real-time data monitoring helps perform better analysis, predict equipment failure, and reduce operating costs. However, IIoT creates enormous volumes
Securing the Perimeter: Cybersecurity at the Edge for OT LAN and Edge Networks
Industrial cybersecurity is a critical focus area for the manufacturing sector, where legacy systems and digital transformation collide. This session, featuring experts from Fortinet, Orange Business, Enfo CyberSec, and Honeywell, explores solutions to secure OT (Operational Technology) networks and protect critical infrastructure. Challenges in
Predictive Maintenance in IIoT: Leveraging Time Series Data for Equipment Longevity
The industrial Internet of Things (IIoT) helps bind machines, sensors, and systems together. They form a network of intelligent devices working together to generate and share data. This approach to managing devices has revolutionized how industries manage, monitor, and maintain