In today’s increasingly sophisticated threat landscape, let’s not overlook the small stuff.

SAINT has once again contributed to Cisco’s cybersecurity report, its annual edition, one of the most comprehensive analyses on the cybersecurity landscape. One thing is undoubtedly clear, adversaries are shifting their tactics to infiltrate companies keeping security staffers and their executive management teams on their toes. Despite the tactical pivots, adversaries are still finding significant success coming through undefended doors. SAINT dug into this on a deeper level in the Cisco annual report by looking at the most common vulnerabilities still present in organizations and left unremediated.

Download the Cisco report in its entirety. SAINT Corporation’s research and analysis is found on pg. 43.

SAINT Corporation examined vulnerability exposure data from more than 10,000 hosts in 2016 and 2017 finding that “TCP timestamp requests enabled” was the most common vulnerability found in hosts left unremediated. This is not surprising or breaking news, but it is extremely concerning as organizations’ threat landscapes becomes more sophisticated. While these are perceived as “low-severity” vulnerabilities, they still represent a security gap that needs to be addressed.

So, what are the key takeaways?

• Many of these vulnerabilities cannot be remediated easily. But this shouldn’t be an excuse to push them further down the remediation checklist.
• Third-party ratings and other outside sources have deemed these vulnerabilities as low-severity; however, companies need to make that final judgement call on whether a vulnerability should get that designation.
• To get closer to achieving true cyber risk resilience, companies need to evaluate and identify remediation priorities based on how they perceive the risks impacting their specific business operations and processes.

SAINT Corporationwill join Cisco and other leading cybersecurity companies next month for a special webinar to discuss the major findings in Cisco’s annual report. We encourage your participation and will send out more details regarding registration in the weeks ahead.