How Misconfigurations Outweigh CVEs in Cybersecurity Risks

-

 

Source: New XM Cyber Research: 80% of Exposures from Misconfigurations, Less Than 1% from CVEs (thehackernews.com)


Research conducted by XM Cyber has uncovered that a whopping 80% of security exposures are due to misconfigurations, while a comparatively minuscule 1% are from Common Vulnerabilities and Exposures (CVEs). Their research, which has studied over 40 million exposures, underlines that more efforts should be directed toward properly configuring systems to reduce cyber risk. 

Focusing solely on CVEs results is a flawed security posture, as misconfigured systems can pose a more substantial risk to critical assets than previously understood. They can create more challenging vulnerabilities, especially since they do not appear on typical vulnerability scans that target software versions rather than configurations. Furthermore, with traditional security measures typically being CVE-focused, the odds of misconfigurations slipping under the radar increase further. 

This research highlights the need to shift the focus, resources, and money from obsessively hunting for CVEs to addressing the elephant in the room through a strategy centered on identifying and correcting misconfigurations. As XM Cyber suggests, organizations can significantly improve their security posture and adopt a more proactive and prudent risk management approach by prioritizing remediation efforts on high-impact exposures and choke points. 

For cybersecurity professionals, this means devoting more time and resources to developing the strategies and tools necessary to drive this shift away from CVE-focused threat hunting. Furthermore, it also necessitates the development of a culture of continuous education and training to ensure that configuration management procedures are instituted and followed on an enterprise level. Ultimately, by addressing misconfigurations, organizations can more efficiently address cyber risk while creating a more robust and resilient cyberspace in which resources are not wasted by excessive targeting of CVEs. 


For a more in-depth overview of the topic, feel free to check out the full report on The Hacker News.

Comments

Post a Comment

Popular posts from this blog

Configuring Secure Cloud Networks with VPN and NAT on AWS: A Personal Project

-
Image
As a passionate and driven cybersecurity enthusiast, I embarked on a side project to enhance my knowledge of cloud security and networking using AWS. This project involved setting up a secure network across two AWS regions using custom VPNs and NAT on EC2 instances. The hands-on experience not only deepened my understanding of AWS but also set me on a path towards better understanding the principles of cloud security as a whole. Objectives and Requirements Objective: Demonstrate configuring a secure network across two AWS regions using custom VPNs and NAT on EC2 instances. Requirements: Select two AWS cloud regions. Create a VPC in each region with distinct CIDR blocks. Configure a public and private subnet in each VPC. Deploy a VPN Gateway VM in the public subnet and a Private VM in the private subnet of each region. Establish a secure tunnel using VPN software between the VPN Gateway VMs. Configure the VPN Gateway VM to provide NAT functionality for the Private VM. Update route table...
Read more

30+ Tesla Cars Compromised Due to TeslaLogger Vulnerability

-
Source:  30+ Tesla Cars Hacked Globally Using Third-Party Software (cybersecuritynews.com) Following up on our most recent blog post regarding the threat posed by misconfigurations, a recent incident impacting Tesla places those findings under a brighter spotlight. Due to vulnerabilities caused by misconfigurations in TeslaLogger, a third-party software used for data logging, security researcher Harish SG uncovered that  its insecure default settings could be exploited  to gain unauthorized access. After Harish discovered the issue, it  was reported  to the platform's maintainer, who  is expected  to have taken actions to mitigate or resolve that risk.  It is essential to clarify that the vulnerability and potential remote access associated with it did not reside in Tesla's vehicles or in Tesla's infrastructure but rather stemmed from misconfigurations surrounding the use of default credentials and improper storage of API keys by TeslaLogger. Desp...
Read more