Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable Blog

Subscribe
  • Twitter
  • Facebook
  • LinkedIn

TL;DR: The Tenable Research 2020 Threat Landscape Retrospective

TL;DR: The Tenable Research 2020 Threat Landscape Retrospective

Tenable’s Security Response Team takes a look back at the major vulnerability and cybersecurity news of 2020 to develop insight and guidance for defenders.

Søren Kierkegaard, the Danish philosopher, once wrote that “life can only be understood backwards” but “it must be lived forwards.” Tenable’s Security Response Team is tasked with looking at the threat landscape on a day-to-day basis and, while that provides us with the ability to see things in the moment, it’s only when we look back at the year that was that we can see the bigger picture.

As we were finalizing our inaugural 2020 Threat Landscape Retrospective (TLR) report, the most notable cybersecurity event in 2020 — and arguably the last decade — was revealed in December. The breach of SolarWinds and its Orion Platform software captivated our collective attention in the final weeks of 2020. While the full picture of the breach and its impact remains incomplete, we believe that as additional information emerges throughout 2021, our ability to truly grasp the full effects and impact will be realized.

SolarWinds became the most significant event of 2020, but for the broader industry, there are many pressing matters to be addressed, such as the top 5 vulnerabilities exploited throughout 2020. These include three legacy vulnerabilities in virtual private network solutions from Citrix, Pulse Secure and Fortinet. These top 5 vulnerabilities, as well as other key takeaways and insights from the year in vulnerabilities, are outlined in the TLR, which security professionals can use to move forward in 2021 with a greater sense of clarity. 

Banner for 2020 TLR report download page

The 2020 Threat Landscape Retrospective

The report begins with an overview of the vulnerability landscape. There were 18,358 new CVEs assigned in 2020, a six percent increase from 2019. From 2015 to 2020, the number of reported CVEs increased at an average annual percentage growth rate of 36.6%.

Number of CVEs Reported Yearly
Source: National Vulnerability Database (NVD) as of January 5, 2021

While the numbers are daunting, they don’t really tell the full story. The TLR explores the nuances of vulnerabilities disclosed last year: noteworthy vulnerabilities, whether or not they were branded; zero-day disclosures from attackers and researchers; the whirlwind summer months and all of the challenges brought on by the COVID-19 pandemic.

Next, we explore the threat landscape in 2020. How were attackers leveraging the vulnerabilities disclosed in 2020, and several that were significantly older? Troublingly, the primary theme of the threat landscape was that threat actors are relying on unpatched vulnerabilities in their attacks. This isn’t anything new but this year, government agencies issued several advisories warning about attackers leveraging vulnerabilities that have patches available and yet remain unmitigated. The TLR explores key insights from these government alerts along with ransomware attacks and major breaches throughout the year.

Timeline of Notable 2020 Government AlertsTimeline of Notable Government Alerts in 2020

The final section of this report will likely be of particular use to security practitioners. It offers a digest of the key vulnerabilities in 2020 — the technical details, whether and how they’ve been exploited, all categorized by vendor or product. If you ever need to describe a vulnerability to a key stakeholder, this is your resource.

How to use Tenable’s 2020 Threat Landscape Retrospective report

  • Understand some of the pitfalls from the shift to the remote workforce
  • Learn how ransomware gangs are breaching organizations and the tactics they’re employing to extract ransom demands
  • Learn some of the common ways data breaches occur and what your organization can do to prevent them from happening
  • Identify and patch any of the vulnerabilities referenced in the report

Learn more

Related Articles

Are You Vulnerable to the Latest Exploits?

Enter your email to receive the latest cyber exposure alerts in your inbox.

Try for Free Buy Now

Try Tenable.io

FREE FOR 30 DAYS

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Sign up now.

Buy Tenable.io

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

65 assets

Choose Your Subscription Option:

Buy Now
Try for Free Buy Now

Try Nessus Professional Free

FREE FOR 7 DAYS

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy Nessus Professional

Nessus® is the most comprehensive vulnerability scanner on the market today. Nessus Professional will help automate the vulnerability scanning process, save time in your compliance cycles and allow you to engage your IT team.

Buy a multi-year license and save. Add Advanced Support for access to phone, community and chat support 24 hours a day, 365 days a year. Full details here.

Try for Free Buy Now

Try Tenable.io Web Application Scanning

FREE FOR 30 DAYS

Enjoy full access to our latest web application scanning offering designed for modern applications as part of the Tenable.io platform. Safely scan your entire online portfolio for vulnerabilities with a high degree of accuracy without heavy manual effort or disruption to critical web applications. Sign up now.

Buy Tenable.io Web Application Scanning

Enjoy full access to a modern, cloud-based vulnerability management platform that enables you to see and track all of your assets with unmatched accuracy. Purchase your annual subscription today.

5 FQDNs

$3,578

Buy Now

Try for Free Contact Sales

Try Tenable.io Container Security

FREE FOR 30 DAYS

Enjoy full access to the only container security offering integrated into a vulnerability management platform. Monitor container images for vulnerabilities, malware and policy violations. Integrate with continuous integration and continuous deployment (CI/CD) systems to support DevOps practices, strengthen security and support enterprise policy compliance.

Buy Tenable.io Container Security

Tenable.io Container Security seamlessly and securely enables DevOps processes by providing visibility into the security of container images – including vulnerabilities, malware and policy violations – through integration with the build process.

Get a Demo of Tenable.sc

Please fill out the form below with your contact information and a sales representative will contact you shortly to schedule a demo. You may also include a short comment (limited to 255 characters). Please note that fields with asterisks (*) are mandatory.

Try for Free Contact Sales

Try Tenable Lumin

FREE FOR 30 DAYS

Visualize and explore your Cyber Exposure, track risk reduction over time and benchmark against your peers with Tenable Lumin.

Buy Tenable Lumin

Contact a Sales Representative to see how Lumin can help you gain insight across your entire organization and manage cyber risk.

Request a demo of Tenable.ot

Get the Operational Technology Security You Need.
Reduce the Risk You Don’t.