Vulnerability Management Is Broken. Here’s How to Fix it
For many organizations, the process of managing software vulnerabilities is not working, and it’s failing to enable security teams to address the software flaws that can lead to major security attacks.
A new study by independent research and education firm Ponemon Institute, based on a survey of 634 IT and security leaders, found that organizations are losing thousands of hours in time and productivity as they deal with a huge backlog of vulnerabilities. They don’t have the resources they need to address these flaws effectively, and the problem will likely get worse.
Nearly half of the respondents said they have a backlog of applications that have been identified as vulnerable, and two thirds said their backlog consists of more than 100,000 vulnerabilities. More than half said they were able to patch less than 50% of the vulnerabilities in the backlog.
The result? A majority of the respondents said high-risk vulnerabilities in their environment are taking more than three weeks to patch, and nearly 30% said it takes them longer than five weeks to patch software bugs. On average, 1.1 million vulnerabilities were in the backlog in the past 12 months.
All of this adds up to an unacceptable situation that’s putting many organizations at high risk.
Current Vulnerability Management Processes and Systems Don’t Work
Several factors are creating challenges for organizations as they try to address the vulnerability backlog. One is the inability to prioritize what needs to be fixed. Another is not having enough information about risks that would exploit vulnerabilities, and yet another is a lack of effective tools and resources.
Many organizations are expending productivity-draining hours trying to address the massive backlogs. For example, 77% said it takes 21 minutes or longer to detect, prioritize and remediate just a single vulnerability in production.
At the same time, many enterprises are struggling to make the most of DevSecOps, a key component for ensuring secure software development. They are facing obstacles to optimizing their use of the model, including the lack of the right security tools, lack of workflow integration, the growing vulnerability backlog, and the growth in application security vulnerabilities.
The Ponemon research makes it clear that organizations need the right tools and strategies to automate the processes of detection, prioritization and remediation of vulnerabilities. Otherwise they can’t realistically manage the vulnerability backlog.
Those organizations that are using automation for vulnerability management are seeing results. For example, more than half of the respondents said their organization uses automation for vulnerability remediation, and of those most said it has yielded significant benefits. When asked how automation has impacted the time it takes to remediate vulnerabilities, 43% said there was a significantly shorter time to respond.
One of the shortcomings of vulnerability management today is the inability to prioritize vulnerabilities, and the key to successful prioritization is to automate the process. Security teams need to automate prioritization to make their remediation efforts more timely and efficient. Automating this process can significantly decrease the amount of time it takes to determine which vulnerabilities are the biggest risks.
In addition to automation, having a mature DevSecOps program should be a big part of the vulnerability management strategy. Organizations must take the necessary steps to advance their DevSecOps programs.
To learn more about how to enhance vulnerability management and software security, read our new guide on managing vulnerability management in DevSecOps, which taps takeaways from the Ponemon research to make recommendations for strategies and best practices. Download the white paper today.