Experts Reaction On DHS CISA and FBI share list of top 10 most exploited vulnerabilities

It has been reported that US cybersecurity agencies have outlined the top 10 most exploited software vulnerabilities across the past 4 years. The report, authored by the Department of Homeland Security Cybersecurity and Infrastructure Security Agency (DHS CISA) and the FBI, urges organisations in the public and private sector to apply necessary updates in order to prevent the most common forms of attacks encountered today. This includes attacks carried out by state-sponsored, non-state, and unattributed threat actors. US government officials argue that applying patches could degrade the cyber arsenal of foreign actors targeting US entities, as they’d have to invest resources into developing new exploits, rather than relying on old and tested bugs.

Experts Comments

May 14, 2020
Martin Jartelius
CSO
Outpost24
This shows quite clearly that while many focus our attention on the “risks and vulnerabilities of tomorrow”, the ones that most frequently will end up hurting us are the ones of yesteryear which we have still not managed to identify and resolve. Predictively most attackers are either using macro-based malware to reach their goals when the endpoints are users, either via tricking users to allow the execution or via massively outdated installations. Other risks that have been observed relate .....Read More
This shows quite clearly that while many focus our attention on the “risks and vulnerabilities of tomorrow”, the ones that most frequently will end up hurting us are the ones of yesteryear which we have still not managed to identify and resolve. Predictively most attackers are either using macro-based malware to reach their goals when the endpoints are users, either via tricking users to allow the execution or via massively outdated installations. Other risks that have been observed relate to exploitation of VPN services, this for the clear reason that this grants the initial foothold into customer environments. If organisations would have to prioritise just one system they would spend that extra love and attention on, the very first to start with, those VPN services constituting that system. Struts exploitation should potentially get attackers an initial foothold on a DMZ or even more preferably on an isolated system, but based on how many networks today are still setup it is clear that targeting those webservers is still a viable path towards network access.  Read Less
May 14, 2020
Eoin Keary
CEO and Cofounder
Edgescan
The DHS report appears to align what we are seeing in the wild, detailed in the Edgescan Vulnerability stats report. CVEs are an attack vector which should be mitigated with good patching and/or maintenance procedures. It’s also of importance to note that common vulnerabilities used to exploit systems are years old and not "zero day" issues. Web application vulnerabilities should also be mentioned, as they open organisations up to code injection attacks and client-side browser attack......Read More
The DHS report appears to align what we are seeing in the wild, detailed in the Edgescan Vulnerability stats report. CVEs are an attack vector which should be mitigated with good patching and/or maintenance procedures. It’s also of importance to note that common vulnerabilities used to exploit systems are years old and not "zero day" issues. Web application vulnerabilities should also be mentioned, as they open organisations up to code injection attacks and client-side browser attack. Ultimately, attackers don’t care where the vulnerability is, which is why a full-stack vulnerability management approach is advised in such a fast-changing threat landscape.  Read Less
What do you think of the topic? Do you agree with expert(s) or share your expert opinion below.
Be part of our growing Information Security Expert Community (1000+), please register here.

Share on facebook
Share on twitter
Share on linkedin

Recent Posts

Information Security Buzz (aka ISBuzz News) is an independent resource that provides the experts comments, analysis and opinion on the latest Information Security news and topics

Twitter Facebook-f Linkedin Youtube

Working With Us

The Pages

Our Contributing Experts