How to overcome your security vulnerabilities

Once upon a time, companies were struggling with their cybersecurity management. More than 50 vulnerabilities, security flaws, and gates to access companies' infrastructure and network for hackers are discovered every day. Faced with this avalanche of threats, companies find themselves overwhelmed and don't know how to properly manage their security vulnerabilities. As professional, we try to help them with some practical and pragmatic advice.

Cybersecurity is not a fairy tale

More and more companies use web applications, migrate to the Cloud (92% of companies will use it in 2018) or improve their business thanks to the DevOps approach (DevOps market is expected to grow by 19% between 2013 and 2020). But all this tech improvement strategies have a common point and a common threat: vulnerabilities. While known vulnerabilities are registered by the CVE, web application vulnerabilities register is called CWE.

For example, digital transformation is so fast that some business cannot keep up with it. According to our RSA study conducted during RSA Conference San Francisco, 42% of IT pros said they ignore critical security issues when they don’t know how to fix them or don’t have the time to address them. Besides the knowledge and human resource gap that the cybersecurity sector is facing, companies cannot afford to stay poorly protected when cyberattacks have never been so numerous. Cyberattacks have doubled in 2017 according to research with more than 159,000 incidents reported in 2017 against 82,000 in 2016. The number should have been higher because many companies did not report breaches.

But you can survive and ward off bad luck

Time, expertise, resources are the critical missing point to keep up with digital transformation and cybersecurity. It is a very actual problematic, according to the Gartner predictions, 60% of IT businesses will experience significant service failures by 2020 due to the inability of IT security teams to manage risk. So, to not let this happen, here is some advice for a safe journey in IT.

How to overcome your security vulnerabilities?

First adventure: Detect and identify threats

Daily, your company must follow best security practices. Not just only pay attention not to open suspicious links or attached documents in email (even email phishing is still a widespread and efficient cyberattack type). Firewalls and anti-virus are a minimum, but companies also must take further responsibilities and manage identity and accesses for example: only give access to the document people need and not to have an open system. This way, if an attack affects a company's service, it will not affect the rest of it.

But is not enough. Companies must know as quickly as possible where and when an attack occurs. A monitoring solution who scan all the time the infrastructure and alert in case of potential threats discover is essential to ensure continuous security.

Once potential risks and vulnerabilities are detected, the company must ask herself this question: which vulnerabilities are the most dangerous for my business? Assess and prioritize vulnerabilities and cybersecurity risks is a significant part of the job. Like the RSA survey shows, IT pros do not know where to start in priority and lose time in remediation.

Second adventure: Remediate and patch

Keeping your system up to date is essential. As we said, vulnerabilities are publicly listed by CVE or CWE. So, cybercriminals and hackers also have access to this information. Not all vulnerabilities are exploited quickly, but your company cannot take the risk.

Once you know your vulnerabilities and which ones or the most dangerous for your business, patch vulnerabilities as fast as you can. If 47% of our RSA survey respondents said, they patch vulnerabilities once its discovered, the majority wait several months. Some companies only patch two times a year and exposed them to high risks.

Things always come in threes: Repeat your effort endlessly

Adventures can get tired, so simplify your life and security. As you know, scanning and patching to keep your infrastructure secure take time. An easy way to ensure continuous security is to have an automated solution that alerts you when a new vulnerability is discovered, classify them and propose adapted remediation solution. Monitor your infrastructure most often you can and not only when you deploy a new instance/application/workload.

Also, if security is not your job, you can trust cybersecurity professionals. Choose an automated and customized solution to fit your customized infrastructure and one which will give you actionable remediation solutions to act quickly and rapidly. Or, you can work with ethical hackers, pen testers or buy managed services from a cybersecurity company who will handle your vulnerabilities, patch them and continuously ensure your security.

Vulnerabilities are nothing new but are often the villain of the story. But the good news is that you can mitigate cyberattacks risks by scanning and patching vulnerabilities as often as needed. This way, your company will live happily ever after.

Outpost24 is engaged since the beginning in vulnerability management issues. Discover more on our way of working and solutions.

Dealing with Vulnerability Management issues? Watch the recording of our webinar to optimize your vulnerability management program.