Story image

Automated Microsoft updates not enough to protect businesses - report

06 Jul 2018

Flexera has released a report revealing desktop apps that pose the biggest risks, so IT can create a plan to prevent attacks.

The Vulnerability Review 2018: Top Desktop Apps report was released as part of the annual report series from Secunia Research at Flexera.  

This new edition focuses on heavily used desktop applications, which can be easily breached through the Internet. 

It also serves as a guide for security patching, helping pinpoint what’s most important and requires immediate action.

“Companies are in desperate need to improve patching so they can reduce risk.  Ultimately that means creating a smart process,” says Flexera research and security senior director Kasper Lindgaard. 

“To do that you have to cut through the noise. Not all software updates are security related, and not all security updates are equally critical. 

“Having patching processes, supported by best-in-class technologies, gives you the visibility and intelligence you need to prioritise and act decisively.”

Most desktop app vulnerabilities pose extreme risk

The report reveals that security professionals need to pay close attention to desktop applications because most vulnerabilities found in these types of apps can be extremely dangerous. 

Whenever new vulnerabilities are reported, Secunia Research issues Advisories assessing their criticality, attack vector and solution status. 

They also create signatures and tested patches for easy configuration and deployment.  

This intelligence by Secunia Research allows desktop admins to quickly identify and prioritise critical security patches. 

Without such information, operation teams struggle to keep up with the large number of patches.

In 2017, 83% of the Secunia Advisories covering the top desktop applications were rated “Extremely” or “Highly” critical (compared to only 17% when you look at Secunia Advisories across all software applications ranked). 

Moreover, desktop applications are extremely vulnerable to attack via the Internet, making them attractive targets. 

94% of advisories relating to desktop apps could be exploited through the Internet, without any interaction with the user, or the need for them to take any action. 

Microsoft’s automated updates aren’t enough

The report also cautions users who incorrectly believe that Microsoft’s automated updates will shield them from vulnerability risk. 

In fact, the majority of desktop app vulnerabilities occur in non-Microsoft applications. 

65% of the vulnerabilities reported in the 50 most common desktop applications were found in non-Microsoft apps. 

The report offers compelling evidence that to significantly reduce corporate risk, security teams must patch non-Microsoft and Microsoft applications.

“Organisations can improve security patching in just three steps,” adds Lindgaard. 

“First, arm desktop admins with security Key Performance Indicators to keep security patching a high priority.  Second, create an inventory of desktop apps to make installing a patch easier.  Finally, put prioritisation and sourcing patches on a schedule, so patches are consistently monitored and applied quickly.”

When armed with vulnerability intelligence, IT professionals can get ahead of security risks with patches for almost all vulnerabilities affecting the most common desktop applications.  

Cryptomining apps discovered on Microsoft’s app store
It is believed that the eight apps were likely developed by the same person or group.
WhatsApp users warned to change voicemail PINs
Attackers are allegedly gaining access to users’ WhatsApp accounts by using the default voicemail PIN to access voice authentication codes.
Swiss Post asks public to hack its e-voting system
Switzerland’s postal service Swiss Post is inviting keen-eyed security experts and white hats to hack its e-voting system.
Spoofs, forgeries, and impersonations plague inboxes
It pays to double check any email that lands in your inbox, because phishing attacks are so advanced that they can now literally originate from a genuine sender’s account – but those emails are far from genuine.
Flashpoint signs on emt Distribution as APAC partner
"Key use cases that we see greatly benefiting the region are bolstering cybersecurity, combating insider threats, confronting fraud, and addressing supply chain risk, to name a few."
The attack surface: 2019's biggest security threat
As businesses expand, so does their attack surface – and that may be the biggest cybersecurity risk of them all, according to Aon’s 2019 Cyber Security Risk Report.
Opinion: Cybersecurity as a service answer to urgent change
Alan Calder believes a CSaaS model can enable a company to build a cyber resilience strategy in a coherent and consistent manner.
Why SD-WAN is key for expanding businesses - SonicWall
One cost every organisation cannot compromise on is reliable and quick internet connection.