Why counting only the number of vulnerabilities per device type isn’t a good indication of network security
People often say that statistics can be read to mean anything. But when it comes down to figures that show how vulnerable your organisation may be to malicious attacks and reputational damage, it’s best to not only have the most accurate information at hand, but also understand it correctly. The security section of the Network Barometer Report 2015 is a good example.
This year, in addition to looking at the security status of networks overall, we delved a little deeper into the vulnerability of specific device types. We wanted to get a clearer picture of exactly which parts of corporate networks tend to be less secure, and why. To most of us, it would seem logical to count only the number of published security advisories – or vulnerabilities – per device type. The more vulnerabilities there are for a particular device type, the more vulnerable it is to attack, right? Not quite. The picture is slightly more complicated than that.
This year, our results show that the highest number of security advisories were published for data centre switches, at 190, and the fewest for wireless devices, at 20. This, however, doesn’t accurately reflect the risk that these device types may pose for a network and the impact it could have if these vulnerabilities were to be exploited. Although the number of security advisories for wireless devices may be low, their penetration rate within this device category is high. In other words, there may only be 20 known vulnerabilities in wireless devices, but these vulnerabilities are so common to the software of these types of devices, that practically all such devices would have them. The implication is that wireless devices pose a greater risk to networks overall than data centre switches do.
Data centre switches may have the highest vulnerability count, but those vulnerabilities are comparatively scarce within this device category. So, overall, data centre switches pose less of a security risk to networks than wireless devices do.
Even so, it’s still not good news for businesses. Both data centres and wireless infrastructures are critical in any organisation. An incident in the data centre switching infrastructure could have a serious and detrimental effect on the organisation’s ability to operate effectively, while security breaches in the wireless access infrastructure could lead to reputational damage and/or data loss. These may be risks you’re not willing to take!
What should you do? Read the full Network Barometer Report 2015 for some sound advice on improving your network security.