{"id":45892,"date":"2021-10-19T06:25:22","date_gmt":"2021-10-19T10:25:22","guid":{"rendered":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/?p=45892"},"modified":"2023-01-08T11:16:02","modified_gmt":"2023-01-08T16:16:02","slug":"government-ransomware-patching-problem","status":"publish","type":"post","link":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/government-ransomware-patching-problem\/","title":{"rendered":"Why patching our way out of the ransomware problem is so hard"},"content":{"rendered":"

Ransomware groups have three ways that they primarily gain initial access to victim networks: phishing, use of stolen login information and exploitation of known vulnerabilities. One of these is not getting enough attention.<\/span><\/p>\n

The first two methods of initial access have gotten a lot of attention. Organizations regularly host phishing awareness training for employees and conduct phishing exercises. After it was reported that the initial access vector for the Colonial Pipeline ransomware attack <\/span>was an old password<\/span><\/a> the ransomware actor likely found on an underground forum, this method has also gotten more attention. Organizations are investing in multi-factor authentication and taking other steps to reduce the likelihood of a successful credential reuse attack.<\/span><\/p>\n

That leaves one last attack method (at least until ransomware groups discover a new attack vector): vulnerability exploitation. Ransomware groups exploiting vulnerabilities got a lot of attention after the REvil ransomware group, or an affiliate, used a<\/span> previously unknown vulnerability<\/span><\/a> (known as a zero-day) in their attack on Kaseya managed service provider customers.<\/span><\/p>\n

But the real challenge when it comes to ransomware and vulnerability exploitation is not zero-days, but the well-known vulnerabilities commonly exploited by ransomware groups.\u00a0<\/span><\/p>\n

To demonstrate the problem of well-known vulnerabilities and ransomware I posted a chart similar to the one above <\/span>on Twitter<\/span><\/a> and asked for feedback from other security professionals who might have seen a ransomware actor exploit a vulnerability I missed. The end result was 47 vulnerabilities across 17 technologies. In other words, there is a huge attack surface that ransomware actors are targeting and, given the number of ransomware attacks so far in 2021, they appear to be winning.<\/span><\/p>\n

This would normally be the part of the commentary where you would expect me to tell you to make sure you patch. And, yes, you should absolutely patch. But, everyone is aware of the need to patch. What I think most people aren\u2019t aware of is the scope of the problem. Those that work in vulnerability management or study ransomware are painfully aware of how many vulnerabilities ransomware actors can exploit, but I don\u2019t think most other people are. A new vulnerability comes out, ransomware actors start exploiting that vulnerability weeks or months later, every security expert tells you to patch it and everyone moves on to the next thing.\u00a0<\/span><\/p>\n

But there is a deeper problem that needs to be addressed. Ransomware actors, and other cybercriminals, are getting more adept at exploiting vulnerabilities and doing so more quickly. In fact, they are often building out exploits for vulnerabilities before most organizations can patch, giving the ransomware actors a big advantage.<\/span><\/p>\n

How can organizations regain the upper hand with vulnerability management? It starts with good asset management. You need a complete and up-to-date asset inventory so you know if your organization is impacted by a new vulnerability.<\/span><\/p>\n

Prioritize patching not by scoring, but by risk. What is the risk to your organization if you don\u2019t prioritize patching this vulnerability? If the risk is a ransomware attack, then that should be a high-priority patch.<\/span><\/p>\n

Finally, communicate that information to the teams that will actually be doing the patching, so they understand why it is a high priority. My experience conducting vulnerability management is that telling a story always gets better results than relaying a number. \u201cThis vulnerability is scored as a 10, so it is critical, please patch it,\u201d does not have the same impact as: \u201cRansomware groups are using this vulnerability to gain initial access, encrypt systems and steal files.\u201d Conveying the severity of a vulnerability in relatable terms is likely to ensure it is prioritized in patching.\u00a0<\/span><\/p>\n

I really want to thank everyone from around the world, especially Twitter user “pancak3lulklz” for his many suggestions, who contributed to the chart shown above. This was a great effort by people from all over the security community, and hopefully it helps to convey the scope of one facet of the ransomware attack surface.<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

Ransomware gets a lot of attention, but there’s a critical aspect of these attacks that’s not talked about enough.<\/p>\n","protected":false},"author":258,"featured_media":45895,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"disable_grayscale_images":true,"grayscale_contrast":0,"sponsored_content":false,"display_author_bio":true,"story_type":"","footnotes":"","jetpack_publicize_message":"{title}\n\n{excerpt}\n\n{url}","jetpack_publicize_feature_enabled":true,"jetpack_social_post_already_shared":false,"jetpack_social_options":{"image_generator_settings":{"template":"highway","default_image_id":0,"font":"","enabled":false},"version":2},"_wpas_customize_per_network":false},"categories":[20646,4677],"tags":[22198,22112,19],"people":[],"special-report":[23774],"authors":[21164],"class_list":["post-45892","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-cybersecurity","category-state","tag-cybersecurity-special","tag-patching","tag-ransomware","special-report-cybersecurity-a-statescoop-edscoop-special-report","author-allan-liska"],"yoast_head":"\nWhy patching our way out of the ransomware problem is so hard | StateScoop<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/government-ransomware-patching-problem\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"Why patching our way out of the ransomware problem is so hard | StateScoop\" \/>\n<meta property=\"og:description\" content=\"Ransomware gets a lot of attention, but there's a critical aspect of these attacks that's not talked about enough.\" \/>\n<meta property=\"og:url\" content=\"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/government-ransomware-patching-problem\/\" \/>\n<meta property=\"og:site_name\" content=\"StateScoop\" \/>\n<meta property=\"article:publisher\" content=\"https:\/\/www.facebook.com\/StateScoop\/\" \/>\n<meta property=\"article:published_time\" content=\"2021-10-19T10:25:22+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2023-01-08T16:16:02+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2021\/10\/GettyImages-867903838-1.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"2121\" \/>\n\t<meta property=\"og:image:height\" content=\"1414\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Allan Liska\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:creator\" content=\"@State_Scoop\" \/>\n<meta name=\"twitter:site\" content=\"@State_Scoop\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/government-ransomware-patching-problem\\\/\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/government-ransomware-patching-problem\\\/\",\"name\":\"Why patching our way out of the ransomware problem is so hard | StateScoop\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/government-ransomware-patching-problem\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/government-ransomware-patching-problem\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2021\\\/10\\\/GettyImages-867903838-1.jpg\",\"datePublished\":\"2021-10-19T10:25:22+00:00\",\"dateModified\":\"2023-01-08T16:16:02+00:00\",\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/government-ransomware-patching-problem\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/government-ransomware-patching-problem\\\/#primaryimage\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2021\\\/10\\\/GettyImages-867903838-1.jpg\",\"contentUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2021\\\/10\\\/GettyImages-867903838-1.jpg\",\"width\":2121,\"height\":1414,\"caption\":\"(Getty Images)\"},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/#website\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/\",\"name\":\"StateScoop\",\"description\":\"Latest news and events in state and local government technology\",\"publisher\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/#organization\",\"name\":\"StateScoop\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2023\\\/01\\\/StateScoop-Black.png\",\"contentUrl\":\"https:\\\/\\\/statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2023\\\/01\\\/StateScoop-Black.png\",\"width\":1470,\"height\":186,\"caption\":\"StateScoop\"},\"image\":{\"@id\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/#\\\/schema\\\/logo\\\/image\\\/\"},\"sameAs\":[\"https:\\\/\\\/www.facebook.com\\\/StateScoop\\\/\",\"https:\\\/\\\/x.com\\\/State_Scoop\",\"https:\\\/\\\/www.linkedin.com\\\/company\\\/statescoop\\\/\",\"https:\\\/\\\/www.youtube.com\\\/@StateScoop\"]}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"Why patching our way out of the ransomware problem is so hard | StateScoop","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/government-ransomware-patching-problem\/","og_locale":"en_US","og_type":"article","og_title":"Why patching our way out of the ransomware problem is so hard | StateScoop","og_description":"Ransomware gets a lot of attention, but there's a critical aspect of these attacks that's not talked about enough.","og_url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/government-ransomware-patching-problem\/","og_site_name":"StateScoop","article_publisher":"https:\/\/www.facebook.com\/StateScoop\/","article_published_time":"2021-10-19T10:25:22+00:00","article_modified_time":"2023-01-08T16:16:02+00:00","og_image":[{"width":2121,"height":1414,"url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2021\/10\/GettyImages-867903838-1.jpg","type":"image\/jpeg"}],"author":"Allan Liska","twitter_card":"summary_large_image","twitter_creator":"@State_Scoop","twitter_site":"@State_Scoop","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/government-ransomware-patching-problem\/","url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/government-ransomware-patching-problem\/","name":"Why patching our way out of the ransomware problem is so hard | StateScoop","isPartOf":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/#website"},"primaryImageOfPage":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/government-ransomware-patching-problem\/#primaryimage"},"image":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/government-ransomware-patching-problem\/#primaryimage"},"thumbnailUrl":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2021\/10\/GettyImages-867903838-1.jpg","datePublished":"2021-10-19T10:25:22+00:00","dateModified":"2023-01-08T16:16:02+00:00","inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/government-ransomware-patching-problem\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/government-ransomware-patching-problem\/#primaryimage","url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2021\/10\/GettyImages-867903838-1.jpg","contentUrl":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2021\/10\/GettyImages-867903838-1.jpg","width":2121,"height":1414,"caption":"(Getty Images)"},{"@type":"WebSite","@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/#website","url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/","name":"StateScoop","description":"Latest news and events in state and local government technology","publisher":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/#organization","name":"StateScoop","url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/#\/schema\/logo\/image\/","url":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","contentUrl":"https:\/\/statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/StateScoop-Black.png","width":1470,"height":186,"caption":"StateScoop"},"image":{"@id":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/#\/schema\/logo\/image\/"},"sameAs":["https:\/\/www.facebook.com\/StateScoop\/","https:\/\/x.com\/State_Scoop","https:\/\/www.linkedin.com\/company\/statescoop\/","https:\/\/www.youtube.com\/@StateScoop"]}]}},"parsely":{"version":"1.1.0","canonical_url":"https:\/\/sandbox.statescoop.com\/statescoop\/government-ransomware-patching-problem\/","smart_links":{"inbound":0,"outbound":0},"traffic_boost_suggestions_count":0,"meta":{"@context":"https:\/\/schema.org","@type":"NewsArticle","headline":"Why patching our way out of the ransomware problem is so hard","url":"http:\/\/scoopmedia-develop.go-vip.net\/statescoop\/government-ransomware-patching-problem\/","mainEntityOfPage":{"@type":"WebPage","@id":"http:\/\/scoopmedia-develop.go-vip.net\/statescoop\/government-ransomware-patching-problem\/"},"thumbnailUrl":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2021\/10\/GettyImages-867903838-1.jpg?w=150&h=150&crop=1","image":{"@type":"ImageObject","url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2021\/10\/GettyImages-867903838-1.jpg"},"articleSection":"Cybersecurity","author":[{"@type":"Person","name":"Allan Liska","url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/author\/allan-liska\/"}],"creator":["Allan Liska"],"publisher":{"@type":"Organization","name":"StateScoop","logo":"https:\/\/develop.statescoop.com\/wp-content\/uploads\/sites\/6\/2023\/01\/cropped-ss_favicon.png"},"keywords":["cybersecurity special","patching","ransomware"],"dateCreated":"2021-10-19T10:25:22Z","datePublished":"2021-10-19T10:25:22Z","dateModified":"2023-01-08T16:16:02Z"},"rendered":"<script type=\"application\/ld+json\" class=\"wp-parsely-metadata\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@type\":\"NewsArticle\",\"headline\":\"Why patching our way out of the ransomware problem is so hard\",\"url\":\"http:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/government-ransomware-patching-problem\\\/\",\"mainEntityOfPage\":{\"@type\":\"WebPage\",\"@id\":\"http:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/government-ransomware-patching-problem\\\/\"},\"thumbnailUrl\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2021\\\/10\\\/GettyImages-867903838-1.jpg?w=150&h=150&crop=1\",\"image\":{\"@type\":\"ImageObject\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2021\\\/10\\\/GettyImages-867903838-1.jpg\"},\"articleSection\":\"Cybersecurity\",\"author\":[{\"@type\":\"Person\",\"name\":\"Allan Liska\",\"url\":\"https:\\\/\\\/scoopmedia-develop.go-vip.net\\\/statescoop\\\/author\\\/allan-liska\\\/\"}],\"creator\":[\"Allan Liska\"],\"publisher\":{\"@type\":\"Organization\",\"name\":\"StateScoop\",\"logo\":\"https:\\\/\\\/develop.statescoop.com\\\/wp-content\\\/uploads\\\/sites\\\/6\\\/2023\\\/01\\\/cropped-ss_favicon.png\"},\"keywords\":[\"cybersecurity special\",\"patching\",\"ransomware\"],\"dateCreated\":\"2021-10-19T10:25:22Z\",\"datePublished\":\"2021-10-19T10:25:22Z\",\"dateModified\":\"2023-01-08T16:16:02Z\"}<\/script>","tracker_url":"https:\/\/cdn.parsely.com\/keys\/sandbox.statescoop.com\/p.js"},"jetpack_publicize_connections":[],"distributor_meta":false,"distributor_terms":false,"distributor_media":false,"distributor_original_site_name":"StateScoop","distributor_original_site_url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop","push-errors":false,"jetpack_featured_media_url":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-content\/uploads\/sites\/6\/2021\/10\/GettyImages-867903838-1.jpg","_links":{"self":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/posts\/45892","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/users\/258"}],"replies":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/comments?post=45892"}],"version-history":[{"count":4,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/posts\/45892\/revisions"}],"predecessor-version":[{"id":45961,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/posts\/45892\/revisions\/45961"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/media\/45895"}],"wp:attachment":[{"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/media?parent=45892"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/categories?post=45892"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/tags?post=45892"},{"taxonomy":"people","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/people?post=45892"},{"taxonomy":"special-report","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/special-report?post=45892"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/scoopmedia-develop.go-vip.net\/statescoop\/wp-json\/wp\/v2\/authors?post=45892"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}