Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe

Cybersecurity Snapshot: 6 Things That Matter Right Now

Cybersecurity Snapshot: 6 Things That Matter Right Now -- July 15 2022

Topics that are top of mind for the week ending July 15 | Government cybersecurity efforts tripped by technical debt. Neglect SaaS security at your own risk. A ranking of the most dangerous software weaknesses. Lessons learned about critical infrastructure security. And much more!

1 – Don’t downplay SaaS security

IT, security and compliance teams pay close attention to Infrastructure- and Platform-as-a-Service (IaaS and PaaS) offerings, but they often overlook the tens or even hundreds of Software-as-a-Service (SaaS) applications used across their organizations, increasing their risk of data breaches.

That’s the main message from the Cloud Security Alliance’s “SaaS Governance Best Practices for Cloud Customers,” a report that outlines risks involved in SaaS adoption and usage, and details how to protect data within SaaS environments.

“While SaaS providers handle much of the responsibility in the Shared Responsibility Model, SaaS consumers are still largely responsible for data governance and access control. This means ensuring who has access to what data, what level of permissions, and under what context,” the report reads.

For example, organizations must make key decisions around:

  • Encryption key management
  • Vulnerability management
  • Backup and storage
  • Incident response and business continuity plans
  • Regulatory compliance
  • Third-party vendor risk

Want to learn more about security best practices for SaaS deployments?

2 – MITRE: Beware these dangerous software weaknesses

Here’s a new report that can help you mitigate your security risks: the “2022 CWE Top 25 Most Dangerous Software Weaknesses.” In this annual ranking, MITRE lists the most common and impactful software weaknesses, all of which attackers can easily find and exploit to take over a system, steal data or torpedo applications. Weaknesses encompass flaws, faults, bugs or other errors in implementation, code, design or architecture.

Topping this year’s list is “Out-of-bounds Write,” in which software writes data either past the end or before the beginning of the intended buffer, which can result in data corruption, a crash or code execution. Suggested mitigations include:

  • Choosing a language and a vetted library that don’t allow this weakness to occur or that provide a construct that makes this weakness easier to avoid.
  • Run or compile the software using features or extensions that automatically provide a protection mechanism that mitigates or eliminates buffer overflows.
  • Run or compile the software using features or extensions that randomly arrange the positions of a program's executable and libraries in memory.

Each entry on the list is linked to a dedicated page for it brimming with details, context, mitigation recommendations and examples. 

Rounding out the top five are:

This list is compiled by the team behind the CWE (Common Weakness Enumeration) community-developed list of software and hardware weaknesses. CWE is sponsored by the Cybersecurity and Infrastructure Security Agency (CISA) and managed by the Homeland Security Systems Engineering and Development Institute (HSSEDI), which is operated by MITRE.

To choose and rank the weaknesses, the CWE team leveraged Common Vulnerabilities and Exposures (CVE) data from the National Institute of Standards and Technology (NIST) National Vulnerability Database and the Common Vulnerability Scoring System (CVSS) scores associated with each CVE record, including CVE records from the CISA Known Exploited Vulnerabilities catalog.

More information:

3 – IDC: U.S.government cybersecurity teams grapple with technical debt

Barriers to the success of cybersecurity initiatives vary among federal, state and local governments, but there’s a common challenge to all: high levels of technical debt. 

That’s according to IDC’s “Government Buyer Intelligence Survey: Analysis of Trends in Cybersecurity Across Federal, State and Local Agencies” presentation, based on a poll of 1,315 IT and non-IT government decision makers.

Technical debt hampers government cybersecurity priority efforts, such as ransomware risk reduction, citizen privacy protection, faster incident response and increased trust in public services, the presentation states. Here’s an IDC chart with more details:

IDC government chart

On the flip side, the cybersecurity investment priorities of local, state and federal governments include cloud security, network security, vulnerability management/assessment, threat hunting and next-gen firewalls.

(Source: IDC “Analysis of Trends in Cybersecurity Across Federal, State, and Local Agencies”, Doc # US49144722, May 2022.)

To get more information about technical debt in government, read:

4 – What have we learned about securing critical infrastructure?

With cyberattacks against critical infrastructure rising, what insights and lessons can we draw from well-known vulnerabilities and recent attacks against these essential assets and resources of society?

That’s the question Tenable Senior Research Manager Giuliana Carullo tackles in her blog “Securing Critical Infrastructure: What We've Learned from Recent Incidents.” Carullo surveys the evolution of critical infrastructure security, pinpoints the challenges of managing vulnerabilities in these environments, and zeroes in on the Colonial Pipeline ransomware attack. 

She also highlights the following vulnerabilities, which have affected this sector in different ways:

Want to learn more about critical infrastructure security? Check out these Tenable resources:

5 – The U.S. government takes on cloud security

Cloud security is top of mind for all organizations using SaaS, IaaS and PaaS offerings, and the U.S. government is no exception. Curious to learn Uncle Sam’s most recent thoughts on this topic? Check out version 2.0 of CISA’s Cloud Security Technical Reference Architecture. 

The document, whose first version came out in August 2021, recommends approaches to cloud migration and data protection so that federal agencies and departments can detect, respond and recover from cyber incidents. It also seeks to help the federal government improve cybersecurity across the board, while understanding the benefits and risks of adopting cloud services. The 70-page paper focuses on three key areas: shared cloud services, cloud software design and cloud security posture management.

For more information read:

6 – Our takeaways from Forrester AppSec tips for security leaders

And finally, there’s this: Applications remain the main vector for external breaches, according to Forrester’s “The State of Application Security, 2022” report. Factors driving this trend include a growth in:

  • Open source vulnerabilities
  • Attacks against the software supply chain
  • Malicious API traffic
  • Use of improperly secured containers 

Forrester recommendations for security leaders include:

  • As they juggle multiple priorities, they should delegate tactical decisions about application security to development teams, which increasingly pick their security tools and control the budget for these products. 
  • With the added time, security leaders should focus on securing their organizations’ product lifecycle to help the business “secure what they sell, increase time-to-market, deliver customer value, and deploy continuously with confidence.”
  • Move from “shift left” to “shift everywhere” by expanding security scanning throughout the software development lifecycle. With this approach, product teams can “develop and deploy with speed and confidence.”

For more information:

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year.

Select Your License

Buy a multi-year license and save.

Add Support and Training

Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy.

Tenable.io BUY

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now

Try Tenable.io Web Application Scanning

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try Tenable.io Container Security

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Try Tenable Lumin

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.

Try Tenable.cs

Enjoy full access to detect and fix cloud infrastructure misconfigurations and view runtime vulnerabilities. Sign up for your free trial now.

Contact a Sales Rep to Buy Tenable.cs

Contact a Sales Representative to learn more about Tenable.cs Cloud Security and see how easy it is to onboard your cloud accounts and get visibility into both cloud misconfigurations and vulnerabilities within minutes.

Try Nessus Expert Free

FREE FOR 7 DAYS

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Already have Nessus Professional?
Upgrade to Nessus Expert free for 7 days.

Buy Nessus Expert

Built for the modern attack surface, Nessus Expert enables you to see more and protect your organization from vulnerabilities from IT to the cloud.

Select Your License

Buy a multi-year license and save.

Add Support