How well do your Linux security practices stack up in today’s challenging operating environment? Do you have the right processes in place to ensure that your systems are up-to date and secure against new threats? Now you can find out thanks to research independently conducted by the Ponemon Institute.
The research sponsored by TuxCare sought to understand better how organizations are currently managing the security and stability of their Linux-based systems. The results allow all organizations operating Linux-based systems to benchmark their processes against their peers and best practices.
You can get a copy of the complete report HERE if you can’t wait to see the findings, but we’ve highlighted the key takeaways below if you’d like a preview.
Research Goals
Comprehensive understanding of the state of Enterprise Linux Security Management is essential. Every year, the number of critical and high-risk vulnerabilities is increasing and exploits to them are becoming more and more common.
TuxCare previously sponsored the Ponemon Institute to research how organizations managed their Linux-based systems’ security and stability. Organizations that use Linux-based systems found this research to be a huge benefit.
Ponemon updated its research to show how the threat management landscape changes and give insights into businesses’ adaptations and refinements. The updated reports provide a deeper understanding of security threats and the mitigation strategies in place.
The Latest Findings
Organizations spend on average $3. 5 million annually monitoring their systems for threats and vulnerabilities and implementing patch management processes. The productivity loss caused by system downtime due to patching is included in this cost.
Organizations spend around 1,075 hours monitoring and patching systems each week. This includes 340 hours of system downtime while applying patches, placing significant pressure on security teams when downtime impacts productivity. In fact, 45% of respondents reported their organization has no tolerance for patching downtime. This is a problem that live-patching solutions can eliminate, hence why 76% of respondents have adopted this technology.
However, the research found that despite this investment, respondents were not completely confident in their ability to quickly find and patch all the critical vulnerabilities in their systems to reduce security risks to an acceptable level. Over 56% of respondents took over a month to patch critical and high-priority vulnerabilities when they realized their systems were vulnerable. Furthermore, 5% of respondents admitted taking over a year to apply critical patches. This is a significant increase in business risk and reflects a worsening of the situation from previous research.
Any system with an unpatched flaw is vulnerable to being exploited. An attacker will need to disclose a vulnerability in order to develop exploitable methods and scan systems for it. Not only does it provide security assurance, but also speedy patching. It can also be critical in meeting regulatory requirements.
Even more surprising was the finding that around a third (assuming hosting companies managed them) are unaware of their responsibility regarding security for cloud-hosted system. Many cloud-hosted systems with no active security management rely on default security controls and luck to avoid an attack.
Conclusions
Organizations are vulnerable because they fail to quickly identify and fix vulnerabilities in all systems that they manage. The research found only 43% of respondents believe they have adequate resources and in-house expertise for timely patching. Respondents also saw lack of accountability in patch management, as well as the assignment of responsibilities to people outside IT security functions.
The research shows that automation is increasing in daily system management tasks. The standardization and repeatability of processes are positive factors in system security and stability, plus respondents who have implemented automation reported a significantly faster vulnerability response time.
To read the complete report and all its detailed findings related to Enterprise Linux Security, you can get your free copy HERE.
