The Critical Failure in Vulnerability Management – Source: www.darkreading.com

Source: designer491 via Alamy Stock Photo

COMMENTARY

Business has slowed considerably in the vulnerability management market segment, yet there are more vulnerabilities to contend with than ever before. When security mainstays experience the same harsh conditions, it’s worth paying attention. 

Through rose-colored glasses, it’s a success story; they’ve reached the top of their intended mountain. More realistically, it’s a final warning that the industry needs to reshape itself quickly to climb the next mountain and deliver more value. 

So, why are we seeing challenges with vulnerability management today? The market segment is folding under its own weight for three main reasons. 

1. Vendors scaled (pun intended) the wrong mountain.

Many vendors built their businesses on the ability to surface vulnerabilities, allowing you to track them, but the risks they introduced weren’t being addressed. Running pen tests is a procedural step to satisfy audits. There’s comfort in being able to say, “Look at the breadth of what we’ve scanned.” However, sometimes more is not better; more scans are just more scans. They demonstrate busyness and address the needs of the governance, risk, and compliance (GRC) program, showing whether recommended compliance settings are locked down. But they don’t answer the question: “Are we secure?”

Related:Critical SAP S/4HANA Vulnerability Under Attack, Patch Now

Additionally, as the industry became more efficient at post-assessments and flagging issues, an unintended consequence was a blow up of alert fatigue, which made it more difficult to find the signal in all the noise and address the risk. The value of being able to report that we identified and fixed X number of critical issues got lost. 

2. The shift to the cloud won’t get us all the way there.

To truly address security risk, the industry is starting to reshape itself. Some vendors are faring better because they have been able to shift their business model from selling traditional vulnerability management to integrated risk management solutions, with a heavy emphasis on cloud. Moving toward hardened or secured foundational or container layers is a good response to software bill of materials (SBOM) risk and a better way to manage vulnerabilities in cloud environments. Of course, it is good for the vendors’ bottom line as well.

The advantage in the cloud is that cloud footprints have a relatively tight control plane, meaning there’s less variation in what needs to be secured and how, since there are fewer moving parts to manage. It’s relatively easy to get a hardened image of Linux, Windows, or even Mac infrastructure. But that isn’t true for network infrastructure.

Related:Sitecore Zero-Day Sparks New Round of ViewState Threats

Network devices are a heterogeneous mix of hardware, software, and firmware. The architecture spans a wide spectrum, from legacy switches running proprietary operating systems to modern white-box systems using open source network operating systems. Finding experts certified in more than one device is difficult, if not impossible. Furthermore, many organizations have generations of devices from multiple different vendors that need to be maintained. Traditional vulnerability management vendors can’t shift quickly enough to address this complexity, and those focused on the cloud aren’t scoped to help. 

3. Network edge devices are the new gateway drug.

Increasingly, threat actors are exploiting vulnerabilities to bypass edge and network devices that are supposed to block their access. Once these devices are compromised, adversaries can move laterally and deeper into the network. 

Between 2023 and 2024, the percentage of edge devices exploited by vulnerabilities grew from 3% to 22%. Additionally, three of the four most-exploited vulnerabilities in 2024 were zero-days affecting edge devices, including: 

Related:WordPress Woes Continue Amid ClickFix Attacks, TDS Threats

Organizations are actively patching network device vulnerabilities; however, only 54% were fully remediated last year, and it took a median of 32 days to accomplish. Meanwhile, the average time to exploit vulnerabilities has dropped to five days.

The Path Forward

The attack surface is expanding, the number of vulnerabilities is increasing, and time-to-exploit is outpacing time-to-remediate, so our risk is rising. 

Network devices are constantly under threat, and the network is vital to keeping the business running. We can no longer afford to relegate network device vulnerabilities to the bonus information on pages 11 through 15 of a scan. Nor should we accept them as black boxes that demand deep expertise and human intervention to remediate. 

Organizations are seeking assistance to fix critical vulnerabilities. As vendors attempt to scale the next mountain to deliver value, we need an approach that treats network device vulnerabilities as urgent and absorbs the complexity of remediation, so teams don’t have to. Solutions that orchestrate and automate network device protection put us on the right path. More specifically:

Teams recognize they have vulnerabilities and can’t keep up. Taking action to address what matters and being able to reply “Yes, we’re secure” is where value lies.

About the Author