Many organisations mandate the installation of security patches, which is an important part of keeping networks and devices secure. However, the very nature of patches means facility managers should not rely on them to keep networks secure.
Security patches are always released after a flaw or security breach has been detected. That means your network was unsecured and vulnerable until the patch was released. In some cases, installing the patch is a bit like closing the gate after the horse has bolted.
Facility managers who rely too heavily on software patches overlook the fact that software is inherently vulnerable. And a cyber breach that enters the organisation through one of these vulnerabilities can literally bring down the entire network, causing many hours of extra work for IT managers, and the potential for serious business ramifications.
These vulnerabilities in software stem from a number of factors.
- First, vendors sometimes release software without adequately testing it. This means the bugs that were present in the original code are still there when the software is used in a production environment, opening it up to attack. The attacks can be many and varied, targeting the network or the device itself.
- Second, the vendor may have thoroughly tested the software but, as is often said, you don’t know what you don’t know. Sophisticated, creative hackers make it their life’s work to find vulnerabilities in software, and then they exploit those vulnerabilities for fun or personal gain.
- Third, the application developer may, in fact, be malicious. Users within organisations are downloading and using apps at a rate never before seen. When company-approved, authorised software does not fit their needs perfectly, business users often take matters into their own hands. This is known as shadow IT. And users, focused on getting the functionality they need as quickly as possible, are rarely aware of the provenance of such apps, let alone the security risks they may pose.
The bottom line is that there are no flawless systems or applications.
Patches can shore up the inevitable flaws and vulnerabilities in software. However, often patches are only developed in response to a hacker discovering the flaw in the first place, meaning the cyber security of the systems and applications will be a step behind and potentially exposed to cyber attacks.
Even worse, when vendors release new versions of applications with the patches built in, attackers can reverse-engineer to work out the vulnerabilities in the previous versions and target them. So even though relying on patches alone is ineffective against hackers, it is still imperative that organisations install patches as soon as they are available to avoid this situation.
[quote style=’1′ cite=”]Facility managers who rely too heavily on software patches overlook the fact that software is inherently vulnerable.[/quote]
For example, Internet Explorer is by far Microsoft’s most vulnerable application and has received more vulnerability patches than the entire Office suite of applications1. However, despite that fact there are multiple known security vulnerabilities and newer, more secure browser options available, unpatchable Internet Explorer browsers are used on almost a fifth of all desktop systems2. Because there are a large number of vulnerabilities in Internet Explorer, and it covers a large market share and install base, the browser is an attack vector of choice for hackers.
When attackers target an organisation they often begin by taking stock of the entire target environment, including machines, operating systems, and common applications and services. If their research reveals the existence of vulnerable applications, such as unpatchable versions of Internet Explorer, they are more likely to develop targeted attacks that exploit new and existing vulnerabilities.
The alternative to patches
When vendor-issued patches are not applied and used properly, or if vendors stop supporting applications, users can become vulnerable to so-called zero-day vulnerabilities. While it makes good business sense to upgrade and install patches wherever possible, there are times when patching simply is not an option and the business needs to find alternative ways to ensure cyber security.
When organisations must operate unpatchable applications and systems, they need to deploy endpoint security systems. This can help prevent security breaches that result from exploitation of known and unknown vulnerabilities.
While individual patches can close software holes that lead to vulnerabilities, endpoint security solutions can identify known threats and prevent them from using those vulnerabilities to gain unauthorised access in the first place, whether the vulnerability was known or not.
For example, attacks that exploit unpatched vulnerabilities typically place malicious code in seemingly innocuous data files. The user opens the file, and the malicious code exploits the unpatched vulnerability, often giving the attacker full control over the endpoint. From here, they can infect your entire environment, steal valuable and sensitive data, and paralyse the business.
The ideal solution focuses on blocking the core techniques that all exploits must use to compromise applications, rather than focusing on individual application vulnerabilities. This approach means that applications are no longer vulnerable, even if security patches are not applied.
Blocking the core techniques provides yet another significant advantage; it means you can block unknown and zero-day exploits just as effectively as known exploits. Furthermore, advanced endpoint protection software can block exploits automatically and transparently.
When an application runs, the advanced endpoint protection software crosschecks it against its own code libraries to search for malicious data files. This activity is entirely seamless to the end user and does not impact the start-up or speed of the applications being protected.
If a malicious data file developed by an attacker begins to execute an exploit technique against an application’s vulnerability, the advanced endpoint protection modules will block the technique and cause the exploit attempt to fail. The software collects data from the incident and reports the details of the failed attempt to the appropriate security managers.
Despite an increase in frequency and complexity of cyber attacks, the operational readiness and availability of IT systems often delay or prevent the application of vulnerability patches to software applications and operating systems. Many applications and operating systems commonly deployed by organisations have also reached their end-of-support and will no longer receive vulnerability patches.
To prevent security breaches on endpoints that operate these unpatchable applications and systems, security professionals must prevent the exploitation of known and unknown vulnerabilities associated with those applications and systems.
Facility managers who focus on blocking the core techniques of exploiting unpatched vulnerabilities are better equipped against zero-day and unknown attacks, and the execution of malware on their systems. Advanced endpoint protection eliminates the need for patching, regardless of the availability or the application of those patches.
—
Gavin Coulthard is systems engineering manager for Palo Alto Networks in Australia and New Zealand.
