alphaspirit - Fotolia
Shodan released a report stating that almost 200,000 services connected to the internet remain unpatched against the OpenSSL Heartbleed vulnerability. Most of the impacted services are in the U.S. and running on the Linux 3.x kernel. Nearly three years since the patch was released, how concerning is this data? What do you think is the biggest reason these services are still unpatched?
The internet is sometimes described as a cesspool, and for good reason. Insecure devices seem to survive longer than anyone might expect; it's like someone discovering a pet python in the sewers.
However, finding systems that are still unpatched against the Heartbleed vulnerability three years after its discovery, despite the widespread awareness, is not surprising -- there are still reports about systems being infected with the Conficker worm almost 10 years after it first came out.
It's important to note that the Heartbleed bug is still being found on the internet, but enterprises are not required to take any new actions if they already addressed the Heartbleed vulnerability. Enterprises should also have already required their vendors to provide them with secure products.
The biggest reasons why the Heartbleed vulnerability has endured are the long life of the vulnerable systems and because many of these systems are managed differently from traditional IT systems. Internet service providers could start blocking systems that are participating in Heartbleed attacks, but this could have other unintended consequences that affect legitimate businesses.
Shodan only scans publicly accessible systems, so its report citing 200,000 vulnerable systems is a very conservative estimate. This number could include embedded systems running OpenSSL that weren't patched via normal processes or that never received a manufacturer update.
Find out how CISOs and IT administrators can share patch management responsibilities
Discover how to prevent Rakos malware attacks on embedded Linux systems
Learn about the impact of malware infections of ICS and SCADA systems
Dig Deeper on Endpoint protection and client security
Related Q&A from Nick Lewis
Cloud penetration testing presents new challenges for information security teams. Here's how a playbook from the Cloud Security Alliance can help ... Continue Reading
Many cloud providers are tight-lipped about internal security control details. Learn how to evaluate cloud security providers with certifications and... Continue Reading
Enterprises new to the cloud can write new security policies from scratch, but others with broad cloud usage may need an update. Consider these ... Continue Reading