Security researchers at Bitdefender said that nearly two-thirds of vulnerabilities found in corporate networksare more than two years old and have not been patched, despite available updates. As it turns out, many businesses are not updating their systems, leaving them at risk.
Bitdefender’s analysis showed that 64% of the bugs that affected businesses in the first half of 2020 involved vulnerabilities that first appeared in 2018 or earlier. This means that organizations are at risk of bugs that they could have fixed long ago.
“The vast majority of organizations are vulnerable to vulnerabilities that appeared between 2002 and 2018,” the report said.
Applying patches can be time-consuming and tedious. Cybercriminals know this and exploit it. But these vulnerabilities can allow hackers to develop malware and infect organizations’ networks. Security experts encourage users and businesses to apply updates to their operating systems and software as soon as they are released. However, many organizations are slow to install them.
According to the report, patching is essential at a time when most employees are working remotely . Remote staff combined with the fact that six out of ten organizations have machines with known vulnerabilities increases the chances of an attack.
In some cases, businesses don't implement security because they fear they could affect the way they manage their systems. They don't realize that a cyberattack could cause much more problems.
Furthermore, according to researcher Liviu Arsene, so-called “backward compatibility” also plays an important role in deciding whether to apply an update or not. “For example, fixing or upgrading an application or service could break compatibility with other software that may be critical to the company. In this case, not applying an update is more of a business decision than a security-based decision,” said the Bitdefender researcher.
However, good network knowledge and having a plan for implementing updates allows businesses to stay secure.
“Systems of compatibility or business continuity should be isolated and there should be strict controls on access to them,” he added.
Source: ZDNet
