hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015A significant number of vendors did not openly acknowledge and remediate weaknessesinherited from OpenSSL before Heartbleed, whereas the trend seemed to change post-Heartbleed.Fewer disclosures were noted for mail server libraries using OpenSSL. Most of these librariesrely on dynamic binding of OpenSSL, which shifted the onus to users to keep their installedOpenSSL packages updated.The “Heartbleed effect” has resulted in not only more vendors opting to remediate OpenSSLissues, but also in improved response time to remediate these issues. The figure belowshows the maximum number of days taken to remediate OpenSSL issues, as measured bynotifications made public. We have averaged across all three OpenSSL issues, adjusting for thecorresponding type of vendor.Figure 32. Maximum days to announce remediation by categoryDatabaseProgramming language/Dev environment030827245687AverageDoS SSIv3_take_mac(CVE-2013-4353)Heartbleed(CVE-2014-0160)CCCS MITM injection(CVE-2014-0224)Appliance76475190Operating system21114Mail server42422562226Web server 7980 20 40 60 80 100 120 140 160 180 200Days to remediationBased on the data above, operating systems have stellar performance when it comes toremediating dependent vulnerabilities. This could be because they are most critical to providingindirect dependence to installed applications via dynamic binding. A slow response fromappliances can be attributed to various reasons:• Often users do not have information about software components that run on their appliances.• Appliances may not be embedded further to create a multi-level dependency, reducing userawareness of the vulnerability and demanding a fix from appliance manufacturer.• Appliances may not be updated easily.• While the worst maximum fix times show up in the Appliance category, in that category thatwas the only appliance that actually pushed a fix for a pre-Heartbleed OpenSSL issue.Most vendors do not maintain and provide a list of all third-party components that theirsoftware depends on, resulting in an incomplete risk profile for users of the components.Furthermore, most licenses, while requiring embedding software to disclose usage of thelibrary, don’t impose version number disclosure on the vendor. We as the software industryneed to make including a list of third-party components along with version number insoftware specification an essential part of the software disclosure for adequate riskassessment for organizations.62