Apu Pavithran, the CEO and founder of Hexnode, suggests that we need to reconsider our approach to patching in the future. It is simply not feasible to address every vulnerability immediately, which makes risk prioritization a justifiable, evidence-based strategy.
In June, the Cybersecurity and Infrastructure Security Agency (CISA) provided compliance teams with an unexpected advantage: the ability to refrain from patching most vulnerabilities, as long as they can justify their choices.
This new guideline aims to redefine the sense of urgency in light of an increasing number of automated vulnerabilities. Consequently, federal agencies are shifting away from updating software based on a schedule or severity rating, opting instead to evaluate risk and expedite fixes for the most critical issues within three days.
This approach is one that businesses should consider emulating at this time. Malicious actors are probing networks more vigorously and shortening the interval between vulnerability disclosure and exploitation. Keeping pace with their speed is nearly impossible, so identifying what should be prioritized and what can be deferred is the next best strategy.
Importantly, chief compliance officers (CCOs) now have valuable support to clarify to auditors or insurers which vulnerabilities remain unpatched and the reasons behind those decisions. Consequently, prioritizing patches is evolving into both a compliance necessity and a security cornerstone.
This transition recognizes the realities of the AI era. Last year, approximately 50,000 common vulnerabilities and exposures (CVEs) were reported, a two-thirds increase from 2023. The idea of “patching everything” immediately upon the discovery of a new vulnerability is no longer practical in this environment.
It is significant that this viewpoint is gaining momentum at the federal level: The nation’s cyber-defense agency is officially directing teams to stop treating all vulnerabilities as equal and instead prioritize based on risk. Under this directive, vulnerabilities are evaluated based on several criteria — public exposure, potential for automated exploitation, whether exploitation grants an attacker full system control, and evidence of real-world exploitation — with only the highest-risk vulnerabilities being expedited. Enterprises should take note of this, as it indicates that the standard-setter is acknowledging that risk-based patching is the preferred approach.
In conjunction with this, NIST’s recent decision to provide fewer vulnerability records with severity ratings and affected product information also reflects the challenges posed by the influx of new vulnerabilities. NIST is choosing to concentrate on threats that appear in the known exploited vulnerabilities (KEV) catalog, those affecting software utilized by the federal government, or those related to “critical software.”
The responsibility is increasingly falling on internal teams not only to determine which vulnerabilities to patch first but also to document the reasoning behind their decisions. This marks a significant shift, as prompt patching has traditionally been a key factor in maintaining favorable relations with auditors and insurers. However, in a triage model, maintaining a clear record of what was not patched and the reasons for it is equally important.
NIST Database Change Rebalances Burden of Risk
The register of common vulnerabilities and exposures will have less federal context, leaving organizations to assess whether a vulnerability requires immediate remediation.
A compliance decision that establishes formal risk acceptance
By adopting strategies from CISA, corporate compliance can be strengthened by addressing the most critical vulnerabilities and documenting the rationale behind each deferral. This represents a positive technical and cultural shift for several reasons.
First, deferral establishes formal risk acceptance. Focusing on the most severe vulnerabilities creates a new decision-making process that alleviates some pressure from IT and involves the CCO. This allows companies to intentionally defer less critical vulnerabilities and link patching to governance with a designated owner, rationale, and record.
Second, it is already known that very few organizations remediate every identified vulnerability. Last year, only 26% of critical vulnerabilities listed in CISA’s KEV catalog were fully addressed by organizations, a decrease from…
Source: Original article