Skip to Content
Uncategorized

Firms Patch Some Bugs Quicker Than Others

Vulnerabilities in core software are dealt with quickly, while other applications have to wait.
July 29, 2009

Companies give priority to patching core software, such as Microsoft’s Windows and Internet Explorer, according to the latest data from vulnerability-scanning firm Qualys.

The firm found that companies take about a month to patch half of all vulnerable systems–a data point the firm refers to as the “vulnerability half-life”–and only 15 days to patch half of their core Microsoft systems. Desktop applications, such as Microsoft Office and Adobe Reader, require far longer to patch, says Wolfgang Kandek, chief technology officer of Qualys. The firm released its Laws of Vulnerabilities study on Wednesday at the Black Hat Security Conference in Las Vegas. Companies are “very, very slow” at patching Adobe software on their desktop systems, Kandek says.

“With Word and Excel, you can see that someone is [patching] the software,” he says. “But with Adobe, they don’t seem to have focused on it yet.”

Qualys, whose service allows companies to scan for known vulnerabilities, released initial data on the trends in vulnerabilities and patching in April. The company found that manufacturing firms were the slowest to patch their systems, taking more than 50 days to patch half their computers, while financial and retail industries took less than 25 days.

The latest study gives more details about another trend: Companies are slow to patch popular, but non-Microsoft, software. Most applications have an automated update feature, or at least check for updates, but many companies do not allow their desktop systems to patch themselves.

“By managing the process themselves, it gives them a chance to check things (such as compatibility issues), but at the expense of being vulnerable,” Kandek says. Adobe expects to patch a major vulnerability in its Flash Player and Adobe Reader and Acrobat later this week.

“The main threats have migrated to the desktop, so it would be a good time to review how you [as a company] patch the desktop,” Kandek says.

Deep Dive

Uncategorized

Five poems about the mind

DREAM VENDING MACHINE I feed it coins and watch the spring coil back,the clunk of a vacuum-packed, foil-wrappeddream dropping into the tray. It dispenses all kinds of dreams—bad dreams, good dreams,short nightmares to stave off worse ones, recurring dreams with a teacake marshmallow center.Hardboiled caramel dreams to tuck in your cheek,a bag of orange dreams…

Work reinvented: Tech will drive the office evolution

As organizations navigate a new world of hybrid work, tech innovation will be crucial for employee connection and collaboration.

lucid dreaming concept
lucid dreaming concept

I taught myself to lucid dream. You can too.

We still don’t know much about the experience of being aware that you’re dreaming—but a few researchers think it could help us find out more about how the brain works.

panpsychism concept
panpsychism concept

Is everything in the world a little bit conscious?

The idea that consciousness is widespread is attractive to many for intellectual and, perhaps, also emotional
reasons. But can it be tested? Surprisingly, perhaps it can.

Stay connected

Illustration by Rose WongIllustration by Rose Wong

Get the latest updates from
MIT Technology Review

Discover special offers, top stories, upcoming events, and more.

Thank you for submitting your email!

Explore more newsletters

It looks like something went wrong.

We’re having trouble saving your preferences. Try refreshing this page and updating them one more time. If you continue to get this message, reach out to us at customer-service@technologyreview.com with a list of newsletters you’d like to receive.