Mitigating Risks Through Effective Patch Management

Mitigating Risks Through Effective Patch Management: Effective patch management is a cornerstone of robust cybersecurity.

This news item highlights the critical importance of proper patch management practices in safeguarding against cyber threats as released by the NSA and CISA.

Key Takeaways to Mitigating Risks Through Effective Patch Management:

• Patch Management Essentials: Regular patching is crucial to protect systems from known vulnerabilities.
• Risks of Neglect: Poor patch management and outdated systems create open doors for cyber adversaries.
• Real-World Vulnerabilities: Examples of exploited vulnerabilities emphasize the urgency of patching.

Understanding Patch Management

Vendors continually release patches and updates to address security vulnerabilities. However, neglecting patch management and ignoring network hygiene can lead to severe security breaches.

The Dangers of Poor Patch Management

1. Lack of Regular Patching:

• Failing to apply timely patches exposes systems to known exploits that are easily discoverable. This oversight expands the attack surface and provides cyber adversaries with opportunities for intrusion.
• Vulnerability scanning and open-source research make these systems immediate targets for adversaries.
• Organizations should prioritize patching known exploited vulnerabilities in their environments.

2. Use of Unsupported OSs and Outdated Firmware:

• Utilizing software or hardware without vendor support presents a substantial security risk. Without updates, both new and existing vulnerabilities remain unaddressed, offering malicious actors opportunities for unauthorized access, data compromise, and operational disruption.
• Vulnerabilities in these systems can be exploited for unauthorized access, data compromise, and operational disruptions.
• Assessment teams frequently encounter organizations using unsupported Windows operating systems without critical updates like MS17-010 and MS08-67, which were released years ago to address remote code execution vulnerabilities.

Exploited CVEs in Public-Facing Applications

Threat actors frequently target public-facing applications, exploiting various CVEs, such as:

• CVE-2019-18935 in an unpatched instance of Telerik® UI for ASP.NET on a Microsoft IIS server.
• CVE-2021-44228 (Log4Shell) in an unpatched VMware® Horizon server.
• CVE-2022-24682, CVE-2022-27924, and CVE-2022-27925 combined with CVE-2022-37042, or CVE-2022-30333 in an unpatched Zimbra® Collaboration Suite.

Mitigating the Risks of Poor Patch Management: Recommendations for Network Defenders

1. Lack of regular patching, do the following:

• Implement and maintain an efficient patch management process that ensures the use of up-to-date, stable versions of OSs, browsers, and software.
• Regularly update software through patch management for externally exposed applications, internal enterprise endpoints, and servers. Prioritize patching for known exploited vulnerabilities.
• Automate the update process, utilizing vendor-provided updates and considering automated patch management tools.
• In cases where patching is not feasible due to limitations, segment networks to reduce exposure of the vulnerable system or host.

2. Use of unsupported OSs and outdated firmware, do the following:

• Evaluate the use of unsupported hardware and software and discontinue their use as soon as possible. If discontinuation is not possible, implement additional network protections to mitigate the risk.
• Patch the Basic Input/Output System (BIOS) and other firmware to prevent exploitation of known vulnerabilities.

Conclusion

Effective patch management isn’t merely a recommendation; it’s a fundamental necessity for cybersecurity.

Neglecting regular patching and relying on unsupported systems significantly elevate the risk of security breaches. Organizations must prioritize patching known vulnerabilities and maintaining up-to-date systems to shield against cyber threats.

This news release is provided by CISA and NCA as part of their commitment to enhancing cybersecurity practices. CISA (Cybersecurity and Infrastructure Security Agency) and NCA (National Cybersecurity Alliance) collaborate to provide valuable insights to organizations, helping them safeguard against cyber threats.