2023年2月7日

這家網絡安全保險公司預測，1900個cve將包括270個高嚴重程度漏洞和155個嚴重程度漏洞。這些預測是基於過去十年收集的數據。網絡安全保險公司Coalition預測，到2023年，平均每月將有1900個嚴重的常見漏洞和暴露(cve)，比2022年增長13%。這些預測是該公司網絡威脅指數的一部分，該指數是根據該公司主動風險管理和降低技術收集的數據編製的，結合了來自承保和索賠、互聯網掃描、其全球蜜罐傳感器網絡的數據，並掃描了超過52億個IP地址。報告稱，1900個cve將包括270個高嚴重程度漏洞和155個嚴重程度漏洞。這些預測是基於過去十年收集的數據。該聯盟的報告稱，對於大多數cve來說，被攻擊的時間是在公開披露後的90天內，而大多數攻擊發生在前30天內。“我們使用季節自回歸綜合移動平均模型進行了預測。我們分析了過去10多年的脆弱性和季節性數據，以預測我們在2023年可能觀察到的新cve的數量、類型和嚴重性。根據我們的模型，我們預計漏洞的數量將繼續增加，”Coalition表示。 Coalition’s honeypots observed 22,000 cyberattacks to develop an understanding of attackers’ techniques. 94% of organizations have at least one unencrypted service About 94% of organizations scanned in 2022 had at least one unencrypted service exposed to the internet, the research noted. Remote Desktop Protocol ( RDP ) is still cyberattackers’ most commonly scanned protocol, which shows attackers continue to prefer leveraging old protocols with new vulnerabilities to gain access to systems. Elasticsearch and MongoDB databases have a high rate of compromise, with signals showing that a large number have been captured by ransomware attacks, the report said. The use of unauthenticated databases increased in 2022, specifically Redis . This is because they are easy to use and scale, the report said. “Many organizations may lack security focus or expertise, meaning they leave these databases misconfigured or configured with no security controls at all,” Coalition said. This leaves the data exposed to the internet, making these organizations more likely to have their data stolen and held for ransom. Coalition recommends that organizations and their security and IT teams prioritize applying updates on public-facing infrastructure and internet-facing software within 30 days of a patch’s release and follow regular upgrade cycles to mitigate vulnerabilities in older software to prepare for the looming 2023 threats. “Cybersecurity professionals must be more alert than ever to vulnerabilities that already exist within their networks and assets. Attackers are becoming increasingly sophisticated and have become experts at exploiting commonly used systems and technologies,” Tiago Henriques, Coalition’s vice president of security research, said in a note. The CESS Predictor This year Coalition created a new scoring mechanism for CVEs called the Coalition Exploit Scoring System (CESS). The CESS is inspired by Exploit Prediction Scoring System ( EPSS ) and Common Vulnerability Scanning System (CVSS) but with a unique focus on delivering custom-built information to assist cyberinsurance underwriting by measuring how likely attackers will exploit a CVE. “Core to the system is the ability to provide security researchers and underwriters with two key pieces of information: the likelihood of exploit availability and the likelihood of exploit usage,” Coalition said. “Our goal for CESS is to create a fully transparent system, explaining exactly how we got to a certain score so that the community can help us improve.” Next read this