STE WILLIAMS

The average PC user in the United States has 75 programs installed on their machine and 7.4% are end-of-life software that no longer receive regular vendor security updates.

This finding comes from a new report published this week by Secunia Research at Flexera Software, that studied vulnerable software on private PCs in 12 countries.

Unpatched software vulnerabilities are popular and obvious attack vectors, and unpatched private devices can ultimately affect businesses whose users do work from home devices. 

The annual rise in vulnerabilities is making is harder for businesses to manage the risks of unpatched software, explains Kasper Lindgaard, director of Secunia Research at Flexera Software, whose firm studied vulnerable software products on private PCs in 12 countries, list vulnerable apps, and rank them by how much they expose PCs to attack.

“Once hackers successfully exploit a vulnerability, they have the ability to start moving around in the businesses and start to gain access to data of all kinds,” he says. “It is then down to the imagination of the hacker what data will be stolen, if it will be leaked, if direct or indirect financial impacts will happen.”

In Q4 2016, some 7.5% of private PC users in the US had unpatched Windows operating systems (Win7, Win8, Win10, Windows Vista). This marks a decrease from 9.9% in Q4 2015, but an increase from 6.1% in Q3 2016. Of the 75 programs installed on each device, 42% are Microsoft programs and 58% come from other vendors.

Lindgaard says he wouldn’t call it “easy” for attackers to exploit Windows machines, but does note that the longer a security patch is not installed, the more time hackers have to develop an effective exploit. For most popular apps, patches are available the same day vulnerabilities are disclosed, meaning businesses and private users can quickly mitigate the risk.

“The fact that this is not happening every time shows that there is work to be done with the software supply chain,” he notes. “The gap between vendors and users, when it comes to users knowing about the vulnerabilities affecting products to applying security patches, is still too wide.”

Fourteen percent of users had unpatched non-Microsoft programs in Q4 2016, an increase from 13.8% in Q3 2016 and 12.2% in Q4 2015. Forty-two percent of vulnerabilities originated from non-Microsoft programs between January and December 2016, according to the Secunia report.

iTunes For the ‘Win’

Secunia ranks the top most exposed programs based on two parameters: percentage of market share, multiplied by how many users neglect to patch them when a patch is available.

The most exposed programs in Q4 2016 were Apple iTunes 12.x. (55% unpatched); Oracle Java JRE 1.8.x/8.x, (50% unpatched); VLC Media Player 2.x (44% unpatched); Adobe Reader XI 11.x (48% unpatched); and Google Picasa 3.x (48% unpatched).

Lindgaard says he’s surprised to see this trend, which is consistent quarter after quarter. “Security updates for each of these products are straightforward to download and apply, if the users are aware of the patches,” he notes.

Awareness is part of the problem. Many products and systems go unpatched because of dysfunctionality in the software supply chain, he continues. Not enough users and businesses are aware to invest in the resources they need to gain overview and solve the dysfunctionality, leading to a slowdown in patching.

Hackers know most private PC users don’t want to put in the effort for regular security maintenance. Researchers found the average device requires 26 different update mechanisms to patch 75 programs.

However, users are still at risk if they continue to run unsupported, end-of-life programs with software vulnerabilities.

“Patch, patch, patch,” says Lindgaard to private users and security pros . “But before you do, make sure you know which products you are running. Second, ensure you have the required vulnerability intelligence, so you actually know when — and what — you need to patch.”

Private users, he explains, should regularly scan their devices and wipe end-of-life programs from their systems. Enterprise security teams should work with software management teams to find and inventory their apps, and remove unsupported programs from the mix.

Related Content:

• Why We Need To Reinvent How We Catalogue Malware
• Speak Up: Ransomware Attack Uses Voice Recognition
• Google Shines Light On Corporate Gmail Threats

Kelly is an associate editor for InformationWeek. She most recently reported on financial tech for Insurance Technology, before which she was a staff writer for InformationWeek and InformationWeek Education. When she’s not catching up on the latest in tech, Kelly enjoys … View Full Bio

Article source: http://www.darkreading.com/vulnerabilities---threats/end-of-life-software-alive-and-well-on-us-pcs/d/d-id/1328247?_mc=RSS_DR_EDT

Securing traditional datacenters used to be all about installing perimeter defenses, such as firewalls, to keep threats away from internal networks. While that was enough a decade ago, today’s next-generation datacenters are prone to advanced attacks from malware and hackers aiming to infiltrate and remain undetected for as long as possible.

Network segmentation using firewalls to protect data and users from cross-contamination can be extremely complicated in large infrastructures and environments. Any form of micro-segmentation increases in complexity as more endpoints are added to a network. Plus, this would require hardware that is not application-aware, and eventually create bottlenecks and performance problems as the network becomes more complicated.

Hyperconverged infrastructures (HCI) that describe software defined datacenters (SDDC) cannot rely on legacy security methods. They need a security model that’s just as flexible as the infrastructure it’s built on. The difference in securing traditional multi-dimensional infrastructures versus converged architectures is that the latter needs a more policy-based approach, intertwining security with applications. Instead of applying a network-based security model, hyperconverged infrastructures require application-based security policies that allow computing instances to communicate with each other, across network segments.

Application-based policies in hyperconverged infrastructures can help reduce complexity and allow security to focus on workloads instead of managing ports, virtual networks and access control lists. Individual computing instances, such as servers, users and workloads, can have security policies that describe their behavior throughout their entire lifecycle. With homogenous software configured for networking, storage and computing running equally across an entire cluster, it’s vital to always know your system’s state and configure alerts for when it changes.

Using more than one hyperconverged vendor helps reduce zero-day exploitation risks that could leave the entire infrastructure vulnerable. Limiting access to control planes for the entire hyperconverged infrastructure is also mandatory, as it helps deny attackers full access to all HCI clusters.

The next-generation datacenter requires new security practices, but that doesn’t mean everything we learned about datacenter security becomes obsolete. Firewalls are still great for securing a datacenter’s network perimeter and network segregation is still recommended. However, these new hyperconverged infrastructures require much more than that, as reducing systems to a single dimension comes with security challenges that need to be addressed.

Liviu Arsene is a senior e-threat analyst for Bitdefender, with a strong background in security and technology. Reporting on global trends and developments in computer security, he writes about malware outbreaks and security incidents while coordinating with technical and … View Full Bio

Article source: http://www.darkreading.com/partner-perspectives/bitdefender/how-to-secure-hyperconverged-infrastructures-and-why-it-is-different/a/d-id/1328237?_mc=RSS_DR_EDT

Law enforcement actions and a relative dearth of zero-day bugs appear to have contributed to a sharp decline in exploit kit activity in recent months.

It’s too soon, however, to say whether the decline represents a permanent or temporary shift away from the use of exploit kits to drop malicious payloads.

A recent report from Trend Micro showed that attacks involving exploit kits fell from 27 million in 2015 to a mere 8.8 million in 2016. The decline was especially noticeable in the second half of last year when attacks against Trend Micro customers involving the use of the notorious Angler exploit kit dropped to near zero from 3.4 million separate attacks in the first quarter of 2016.

Much of the sudden decline in exploit kit activity, according to Trend Micro, appears related to last year’s arrest of 50 individuals in Russia believed associated with the Angler exploit kit. The arrests resulted in an almost immediate and significant drop off in exploit kit activity. To put that in perspective, Angler in 2015 accounted for more than 57% of all recorded incidents involving exploit kits.

In addition, Neutrino and Nuclear, two other popular exploit kits also stopped being actively used in 2016. While it is not clear what prompted their demise, it is likely that a lack of zero-day vulnerabilities played a part. There were a lesser number of zero-day vulnerabilities in 2016 compared to previous years making exploit kits less lethal than usual.

“The shelf life of exploitable vulnerabilities and zero-days is decreasing rapidly,” says Patrick Wheeler, director of threat intelligence at Proofpoint another vendor that has reported a sharp decline in exploit kit activity recently. Total exploit kit activity declined a massive 93% between January and September last year, according to Proofpoint

Angler itself has been replaced by another exploit kit dubbed RIG. But overall attack traffic volume associated with exploit kits is nowhere near their highs of 2015.

“Essentially, software developers, security vendors, and organizations are patching vulnerabilities so rapidly now that exploit kits are simply much less effective than they used to be,” he says. This has made it hard for threat actors to achieve reasonable returns on their investments in exploit kits.

“Malicious email volumes have increased dramatically while mobile attack kits and [exploit kits] for IoT devices and routers have all emerged to fill the void,” he says.

Enterprises should not be lulled into a sense of false security by the drop off in exploit kit activity, says Jon Clay, director of global threat communications at Trend Micro. The decline does not necessarily mean exploit kits will not continue to be used in attacks, he says.

Vulnerable systems are still a viable way to compromise a system and gain a foothold into an organization. Enterprises should not use the trend as an excuse not to do proper patching, he says.

“We have started to see private exploit kits being developed and used by cyber gangs,” with the resources to develop such kits on their own, he says. The operators of Lurk and Pawn Storm espionage campaigns are two examples of threat groups that have used their own exploit kits to attack targets, he says.

“So we could be seeing a trend where exploit kits go private versus public,” he cautions.

Michael Marriott, a research analyst at Digital Shadows, says there’s been a great deal of change in the exploit kit landscape over the past year. But it would be a mistake to overestimate the impact of the demise of Angler and Nuclear exploit kit activity.

He points to the recent public release of source code for an exploit kit dubbed Sundown as one example of the continued threat actor interest in exploit kits. “Following the release of this source code, it’s likely we will see more exploit kits being sold across criminal forums,” he says.

“By understanding the most popular exploit kits, as well as the vulnerabilities they most commonly exploit and their favored attack vectors, organizations can learn which vulnerabilities to patch as a priority,” Marriott says.

Related Content:

• Researchers Disrupt Angler Exploit Kit, Ransomware Operation
• Angler Climbing To Top Of Exploit Heap
• State Of The Exploit Kit
• Executable Files, Old Exploit Kits Top Most Effective Attack Methods

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year … View Full Bio

Article source: http://www.darkreading.com/attacks-breaches/exploit-kit-based-attacks-decline-dramatically/d/d-id/1328246?_mc=RSS_DR_EDT

After delaying its Patch Tuesday security release slated for February 14 reportedly owing to a last-minute hitch, Microsoft this week issued security patches but only for some vulnerabilities, Fixes for two known zero-day vulnerabilities were not addressed in the release, notes security expert Graham Cluley.

The February 21 release covers vulnerabilities in Adobe Flash Player for Internet Explorer users on Windows 8.1 and Edge for Windows 10. Missing, however, were the flawed Windows handling of SMB traffic and another software bug made public by Google last week.

Both these flaws can be exploited if not fixed soon: exploit code for the flaw involving memory corruption bug was published on GitHub, for example, and can be used to launch distributed Denial-of-service attacks.

Read more here.              

Dark Reading’s Quick Hits delivers a brief synopsis and summary of the significance of breaking news events. For more information from the original source of the news item, please follow the link provided in this article. View Full Bio

Article source: http://www.darkreading.com/vulnerabilities---threats/microsoft-releases-security-updates-for-some-not-all-flaws/d/d-id/1328248?_mc=RSS_DR_EDT

The economics of supply and demand shape today’s cybersecurity job market. Each year, US employers post more than 120,000 openings for information security analysts and roughly one-third go unfilled. Hiring managers are bracing for a continuation of this trend, with demand for cybersecurity professionals expected to grow steadily through 2018.

Unsurprisingly, cybersecurity salaries reflect this severe talent scarcity. The median annual wages for information security analysts is more than 10% greater than that for all computer occupations, and almost 150% higher than that of all US occupations, according to the Bureau of Labor Statistics. And as high-ranking roles including chief security officers begin reporting directly to CEOs and corporate boards, compensation is likely to jump further.

For those with the right skills and experience, it’s a job-seeker’s market. But universal demand and negligible supply don’t change the fact that cybersecurity is an evolving field. Strategies, threats, and the skills to combat them can and will pivot over the coming months, making it more difficult for candidates to qualify — and stay relevant — for these lucrative opportunities.

Landing the Job, and Rising through the Ranks
Faced with boundless opportunity and constant change, IT professionals need to make strategic choices about their own development to build a long-term cybersecurity career. Here are four areas to keep in mind as you map out your five-year plan:

1. Progressive certifications: Technical certifications are valuable for any IT professional hoping to stand out in an applicant pool, and the same rules apply to cybersecurity jobs. For entry-level, midcareer, and executive positions alike, employers increasingly want verification of job-seekers’ security chops. Foundational certifications such as CompTIA’s Security+ are becoming a prerequisite for anyone starting a cybersecurity career, demonstrating a solid grasp on IT threats, compliance, and identity management — but by no means should your education end there. From the International Information System Security Certification Consortium’s Certified Information Systems Security Professional (CISSP) and CompTIA’s Cybersecurity Analyst (CSA+) and Advanced Security Practitioner to ethical hacking certifications, there are ample opportunities for training and specialization targeted at more experienced professionals looking to move up the ladder.
2. Strategic communication skills: Cybersecurity does not fall only under a CISO or IT department’s purview. Responsibility (and accountability) for defending corporate data and devices lies, in part, with end users, C-suites, and boards of directors as well. Cybersecurity experts must be able to communicate effectively with each audience, whether to educate employees about the dangers or secure buy-in for new security investments. To graduate into senior leadership roles, cybersecurity professionals need to demonstrate communication mastery with external audiences. As more organizations become embroiled in data breaches and legal matters (over issues such as encryption), they’ll need experts with not only technical smarts but the capacity to navigate crisis communications and public sector partnerships. 
3. Government clearances: Almost all industries are in need of more cybersecurity manpower, but the public sector is one vertical playing a fervent game of catch-up. Per the Federal Cybersecurity Workforce Strategy released last July, the government is on the hook to more proactively identify internal cybersecurity gaps, better recruit security experts, and develop career paths to retain top talent. Beyond technical certifications, public administration cybersecurity jobs are almost three times as likely to require security clearances than cybersecurity openings in general. Obtaining the appropriate clearances in advance can set a resume apart, and expedite the hiring process.
4. Digital forensics: As organizations and governments around the world accept the inevitability of cyberattacks (or, at least, attempts), greater attention and resources must be paid to what happens in their wake. The field of digital forensics — extracting “evidence” from devices and other IT systems to understand, potentially prosecute, and later prevent, cybercrimes — is in need of more than a few good recruits. As threats from state-sponsored actors, organized crime groups and hacktivists rise, the public and private sectors need experts who specialize in reverse-engineering attacks and threat hunting. Professionals who concentrate their training around digital forensics now will be invaluable as the cybersecurity landscape becomes more globalized and litigious.

Despite employers’ pressing need for cybersecurity talent, job and promotion-seekers need to take a calculated approach to developing their careers. Tremendous responsibility and generous salaries aren’t simply up for grabs — they’re the reward for professionals with the most comprehensive, future-proof expertise. 

Related Content:

• 8 Valuable Security Certifications For 2017
• Closing The Cybersecurity Skills Gap With STEM
• You Can’t Hire Your Way Out of a Skills Shortage … Yet
• The Sorry State Of Cybersecurity Awareness Training

Todd Thibodeaux is the president and chief executive officer of the Computing Technology Industry Association, the leading trade association representing the business interests of the global information technology industry. He is responsible for leading strategy, development … View Full Bio

Article source: http://www.darkreading.com/careers-and-people/road-map-to-a-$200000-cybersecurity-job/a/d-id/1328218?_mc=RSS_DR_EDT