Unauthenticated
Last year saw the largest number of vulnerabilities in IT software and systems on record, according to Risk Based Security. This has created an unworkable situation in which "there are too many vulnerabilities for organisations to remediate...and they are being disclosed too quickly for organisations and security teams to keep up," its report says. Vulnerabilities are defined as weaknesses in information systems, procedures, controls or implementation that could be exploited. There were 28,695 of them last year but, more tellingly, Risk Based Security says there were 287 in a single day.
Some of these issues are identified by researchers who report them to the manufacturer so they can be addressed, but many are bought and sold on the grey market. After all, the prospect of earning millions of dollars is awfully tempting when responsible disclosure will earn less than $200,000. Just for context, Washington DC-based Zerodium says it will pay up to $2.5 million for a chain of vulnerabilities that can be used to break into an Android device without the user doing anything. Last year, the maximum reward paid by Google for an Android vulnerability was $157,000. Clearly, an equation that is unlikely to have a happy outcome.
Industry experts drone on about the need for organisations to patch their systems quickly, to make sure their staff don't do stupid things, to adopt multi-factor authentication. We don't disagree, but we would respectfully point out that when 287 vulnerabilities are announced in a single day, there may be a fundamental issue to address. Some of the reasons for vulnerabilities are clear, not least that most software is built on decades of previous work. But there's also a constant drive to add yet more features before fixing existing problems. There's no easy answer, but the current situation creates an unacceptable and insuperable level of risk for organisations and individuals.
