MICROSOFT VULNERABILITIES REPORT 2019 - BeyondTrust

Microsoft Vulnerabilities Report 2019“The 2017 NotPetya attack (which causedat least 10 billion in world-wide damages)provides an excellent demonstration of howvulnerabilities in commonly used softwarehave been weaponized. Because ransomwareand disk wipers work so well, and becauseof static cybersecurity defences and digitalweapons proliferation, we can expect to seemore critical patches will be issued in thefuture.“If routinely installingcritical patches is thedigital equivalent ofwashing your hands afterusing the toilet, then wecollectively have terriblecyber hygiene.warnings or prompts. These practices canapply to any company concerned aboutpreventing data breaches as the ASDhas many similarities with the mandatesfor GDPR, NIST, and PCI.The four, in order, are: Applicationwhitelisting; Patch applications; Restrictadministrative privileges; and Patch operatingsystems. ASD says properly implementingthe Top 4 will mitigate over 85% of thecollective adversary’s targeted maliciouscode techniques.Did you know the patch to neutralizeNotPetya had been released by Microsoft90 days prior? If routinely installing criticalpatches is the digital equivalent of washingyour hands after using the toilet, then wecollectively have terrible cyber hygiene.The best way I know to improve your digitalhand washing is to adopt the “Top 4” from theAustralian Signals Directorate(ASD). These four mitigations have beenselected and prioritized specificallyto counter the delivery and executionof malicious code, including thosevulnerabilities that can be exploited without10Here’s an example: In a prior CISO role, myteam removed local admin rights for ourentire company of about 1,000 desktop andlaptop computers. Lots of people told us itcouldn’t be done. But, in the end our peoplewere even more productive without localadmin rights.”“EXPERT COMMENTARYCISO ViewpointKIP BOYLECEO, Cyber cyberriskopportunities.comfiredoesntinnovate.com

Academic ViewpointEXPERT COMMENTARYThis increase can be attributed to the factthatno matter how much attention is givento new advances in technology, the amountof attention given to who can access whatdata is often lacking. An organization’s criticalassets face threats that extend beyond therealm of technology. Its processes andemployees can expose sensitive data in waysthat cannot be mitigated with technicalcontrols alone.While organizations take actions to controlaccess to its highly sensitive informationwith strict access controls, other types ofdata are often left “wide open.” This meansthat anyone who uses seemingly legitimatecredentials to access the network can accessmost of the organization’s data.I have emphasized many times that if youwant to reduce organizational securityrisks, you must control access, especiallyto privileged accounts. The simple fact isthat if you’re going to prevent bad actorsfrom getting in and insiders from abusingaccess privileges, you must have expertmanagement of your privileged accounts.While there is no silver bullet for achievingfull-proof cybersecurity, organizationscan dramatically reduce the impact of anattack by prioritizing privileged access.Organizations must choose the right access“While there is nosilver bullet for achievingfull-proof cybersecurity,organizations candramatically reduce theimpact of an attack byprioritizing privilegedaccess.““The data does not lie! It has been clearlydemonstrated that despite the manyadvances in cybersecurity techniques andtechnology the number of vulnerabilitiescontinues to drastically increase year afteryear - with no end in sight.Microsoft Vulnerabilities Report 2019control model based on the types ofdata they process, how sensitive that data is,and operational requirements. With a goodprivilege access management model andprocesses, these organizations can enforce11least privilege policies. This will empowerthem to reduce the threat of security attacks& data breaches.Privileged access management acts as asecure repository, or vault, that protects anorganization’s data and networks. By adoptingprivileged user management, an organizationcan ensure that users only access thedata required to do their job. IT teams willbe able to establish parameters that willprevent users from accessing systems andinformation that they should not.As a university professor, I tell my studentsthat security is really very simple. Controlaccess to control the threat! If bad guyscannot get into an environment in the firstplace, they can do no harm.”PROFESSORDEREK A. SMITHSpeaker, Author & UniversityProfessor, President of theIntercessor’s Investigative &Training ok.com/derekasmith53theintercessorgroup.com

“It is often easy to be pessimistic whenseeing that the number of vulnerabilitiesfound per year has grown at an alarming rate.With a 110% rise in the last six years, it wouldseem that criminal hackers are gaining theupper hand. But, when we look at the contextof these vulnerabilities, we can be moremeasured - and in fact more optimistic - inour response. More vulnerabilities are beingdiscovered partly because more and moresoftware is being developed every year. Butmore vulnerabilities are also being discoveredbecause we as an industry are gettingsmarter and better and faster at finding anddisclosing them, with more people than everare looking for vulnerabilities comparedto six years ago. We have also seen moreorganizations hiring penetration testers andsetting up bug bounty programs.If we look at the history of vulnerabilities wesee that the same classes of vulnerabilitieshave constantly appeared at the top of theOWASP (Open Web Application SecurityProject) Top 10 and it is shocking that certainclasses, such as SQL Injection and XSS, arestill such a big problem today. This reporthighlights the issues with misconfigurationof user privileges and it would be easy todemand that systems administrators do notoffer administrative rights to all users andto argue that they are lax when applyingpatches to systems. But it is easy to pick faultwith people when, in fact, surrounding factorsare sometimes pushing people to behave incertain ways.Microsoft Vulnerabilities Report 2019“The MicrosoftVulnerabilities Report2019 supports theimportance of leastprivilege models, provingthat reducing thenumber of admin usersis a necessary step inthe foundation of yoursecurity strategy.“EXPERT COMMENTARYCEO Viewpoint12The Microsoft Vulnerabilities Report 2019supports the importance of least privilegemodels, proving that reducing the numberof admin users is a necessary step inthe foundation of your security strategy.Reviewing and verifying access lists is animportant, and often overlooked, part of thatprocess. Likewise, whitelisting applicationsis an effective mitigation, but people andprocesses need to be in place to managewhitelisting to prevent it from becomingperceived as a business-blocker.”DR. JESSICA BARKERCo-CEO of Cygenta &Chair of ClubCISO@drjessicabarker@CygentaHQcygenta.co.uk

“During the security assessments we haveconducted in the past few years, we’venoticed that one of the most common issuesobserved is the extensive usage of privilegedaccounts by users who do not need them fordaily work. Sometimes, this practice makesusers’ work easier, but as the MicrosoftVulnerabilities Report demonstrates, it alsoopens many dangerous attack vectors and isone of the main reasons why ransomware hasbeen spreading so successfully.The running of malicious code by a userwith administrative privileges may allowthe attacker to perform a lot of differentactivities; for example, it allows to accessthe memory of system processes like LSASSto extract users’ credentials, includingpassword hashes and other sensitive data.Once hashes are obtained, the attackermay use them to perform Pass-The-Hashattacks to gain access to other machinesin the network. Another scenario toconsider is whether privileged users maybe able to turn off endpoint protectionmechanisms like antivirus solutions or hidemalicious activities, which prolong the timeof discovering them. Privileged AccessManagement solutions that include securing,managing, and controlling endpoints andpasswords reduce these types of risks.A successful cyber attack may result in anextensive financial loss for the companyand disclosure of confidential informationand know-how. The attack may also causedisruption of services provided by thecompany, like online services, productionlines or by leading to physical damageMicrosoft Vulnerabilities Report 2019of devices. That’s why it’s also advisableto perform penetration tests as they areone of the most efficient ways to identifytechnical vulnerabilities in the company’s ITinfrastructure before the attack occurs.The main goal of each test is to find asmany vulnerabilities as possible that couldmake the work of a potential hacker mucheasier and put the organization at immenserisk. After a penetration test is performedby companies specializing in security,like CQURE, a report is prepared with adetailed description of all findings withrecommendations on resolving them, makingit much easier for the customer to implementcrucial mitigations.13“During the securityassessments we haveconducted in the pastfew years, we’ve noticedthat one of the mostcommon issues observedis the extensive usage ofprivileged accounts byusers who do not needthem for daily work.“EXPERT COMMENTARYService Provider ViewpointPAULAJANUSZKIEWICZCybersecurity Expert & CEOof cqureacademy.com

Microsoft Vulnerabilities Report 2019The BeyondTrust Analysis- MethodologyABOUT THIS REPORTEach bulletin issued by Microsoft contains anExecutive Summary with general information.For this report, a vulnerability is classifiedas one that could be mitigated by removingadmin rights if it meets the following criteriaare stated by Microsoft in vulnerabilitybulletin: Customers/users whose accounts areconfigured to have fewer user rights on thesystem could be less impacted than userswho operate with administrative user rights If the current user is logged on withadministrative user rights, an attacker couldtake control of an affected systemHow Microsoft ClassifiesVulnerabilitiesEach vulnerability can apply to one or moreMicrosoft product. This is shown as a matrixon each vulnerability page.Each vulnerability is assigned a type from oneof seven categories; Remote Code Execution,Elevation of Privilege, Information Disclosure,Denial of Service, Security Feature Bypass,Spoofing, Tampering– which occasionally varydepending on the individual piece software orcombination of software affected.A vulnerability of each type often appliesto a combination of different versions ofa product or products, and sometimesall versions – e.g. all versions of Windowsclients. Often, a vulnerability will only applyto a combination of products – e.g. InternetExplorer 11 on Windows 7.Each vulnerability is also assigned anaggregate severity rating by Microsoft –Critical, Important, Moderate – which alsovaries depending on each individual pieceof software, or combination of softwareaffected. The Common Vulnerability ScoringSystem (CVSS is a published standard usedby organizations worldwide and provides away to capture the principal characteristics ofa vulnerability and produce a numerical scorereflecting its severity. The numerical scorecan then be translated into a qualitativerepresentation (such as low, medium, high,and critical) to help organizations properlyassess and prioritize their vulnerabilitymanagement processes.Certain vulnerabilities have occurred multipletimes throughout 2018, usually affectingdifferent software. In these cases, thevulnerability itself is only counted once, withall affected software types attributed to thatone entry.14Accuracy of VulnerabilityDataA number of generalizations have been madefor each vulnerability as follows: Each vulnerability was classified with thehighest severity rating of all instances ofthat vulnerability where it appeared multipletimes Each vulnerability was classified with themost prevalent type for all instances of thatvulnerability Product versions were not taken intoaccount Product combinations were not taken intoaccount Vulnerabilities were counted for both thesoftware and version where appropriate (forexample, a vulnerability for Internet Explorer11 on Windows 10 is taken as a vulnerabilityfor both Internet Explorer 11 and Windows10)

About BeyondTrustBeyondTrust is the worldwide leader in Privileged Access Management, offering the most seamless approach to preventing data breaches relatedto stolen credentials, misused privileges, and compromised remote access. Our extensible platform empowers organizations to easily scaleprivilege security as threats evolve across endpoint, server, cloud, DevOps, and network device environments. BeyondTrust gives organizationsthe visibility and control they need to reduce risk, achieve compliance objectives, and boost operational performance. We are trusted by 20,000customers, including half of the Fortune 100, and a global partner network.About Endpoint Privilege ManagementBeyondTrust’s Endpoint Privilege Management solutions give you the power to enforce least privilege and eliminate local admin rights.Remove excessive end user privileges and control applications on Windows, Mac, Unix, Linux, and network devices - all withouthindering end-user productivity.About Vulnerability ManagementBeyondTrust’s Vulnerability Management solutions reduce risk with cross-platform vulnerability assessment and remediation, including built-inconfiguration compliance, patch management and compliance reporting.beyondtrust.com

Each Microsoft Security Bulletin is comprised of one or more vulnerabilities, applying to one or more Microsoft products. Similar to previous reports, Remote Code Execution (RCE) accounts for the largest proportion of total Microsoft vulnerabilities throughout 2018. Of the 292 RCE vulnerabilities, 178 were considered Critical.