We would like to keep you up to date with the latest news from Digitalisation World by sending you push notifications.
Digital Newsletter
Each week our editor Phil Alsop rounds up the most popular articles, videos and expert opinions. We compile this into a Digital Newsletter and send it straight to your inbox every week.
Digital Magazines
We'll let you know each time a new edition of Digitalisation World is released so that you're always kept up-to-date with the latest and greatest news and press releases.
Video Magazines
The Digitalisation World Video magazine contains the latest Zoom interviews with experts in the industry.
The highest average number of days to resolve vulnerabilities was associated with those that were low-risk, which took 96 days to fix on average. Critical and medium-risk vulnerabilities closely followed, with it taking on average 74 and 77 days to resolve these vulnerabilities respectively.
Often, this delay was due to NCC Group researchers having no clear point of contact with whom to disclose the vulnerability. In many cases, staff resorted to contacting social media teams in an effort to find a secure channel of communication through which to disclose the vulnerability, often with no response.
This analysis also uncovered that only 2.4% of vulnerabilities found and reported resulted in a CVE – a number used to uniquely identify a vulnerability with the aim of providing a comprehensive list of all publicly known vulnerabilities.
Matt Lewis, research director at NCC Group, said: “Our analysis highlights a clear knowledge gap when it comes to the resolution of vulnerabilities. Improving our industry’s ability to detect vulnerabilities before they become an issue is less of an achievement without an established process in place for their remediation and disclosure.
“There also seems to be a false sense of security among businesses when it comes to low-risk vulnerabilities. These are vulnerabilities nonetheless, and we’re seeing an increase in bug chaining attacks, which exploit multiple low-risk issues across infrastructure to achieve full, unauthorised control of the underlying system.
“The fact that the majority of vulnerabilities uncovered by our researchers over the last nine years have not been fixed demonstrates that there are likely far more zero-day vulnerabilities in existence than we might think.”
