The prevalence of accidents, like that of vulnerabilities, tells us there is no perfect thing. And even if any given vulnerability is unexpected, we know from experience that the existence of vulnerabilities is inevitable. Hackers know this too, of course, and a determined hacker will use whatever tools are available to him to find vulnerabilities to exploit. One of the most obvious tools for a hacker is research, and simply inspecting the data your application publishes about itself can yield helpful information to a hacker. But how much data your application makes available to hacker research is within your control. It is feasible to mitigate the risk of hacker research by implementing policy compliance best practices. As a Policy Compliance signature developer, I will take Apache HTTP Server as an example to illustrate how applications can leak data that is helpful to hackers, and how you can prevent it.
At Infosecurity Europe today, Qualys announced it analyzed QualysGuard Policy Compliance (PC) data from more than five million scans performed by organizations worldwide to help enterprises understand key trends as they plan their compliance strategies.
Key trends include:
- A large number of devices scanned – more than half of the scan target – are out of support, showing that companies are depending on a large number of computer technologies, especially operating systems that are no longer supported by their manufacturers through standard support.
- Newer computer technologies have a higher rate of passing compliance, confirming the general trend of higher security for newer technologies also on the compliance side.
- Companies with more frequent compliance scans have a higher rate of passing scans. This trend confirms recent findings in the area of Continuous Monitoring, where organizations that monitor more frequently also show accelerated improvements.
- Passwords are high on controls lists. Thirteen out of the top 20 controls are password-related. At the same time, top failing controls are password related