Why has the Heartbleed threat window been left wide open?

Six months have passed since news of Heartbleed first emerged, but enterprises don't seem to appreciate the threat it poses still persists

The Heartbleed bug is yesterday's news and no longer something we need to worry about, right? Wrong.

The problem is too many people think this way, which has led to the situation where many enterprises still have machines that are unprotected from the flaw.

Security outfit Venafi probed the Forbes Global 2000 list of companies 10 days ago and discovered more than half - across banking, health and retail sectors - still had devices that were vulnerable. In fact, 1,219 out of the 2,000 companies, and 448,000 potentially vulnerable servers, were detected.

Last week IBM said it sees some 7,000 attempts to exploit Heartbleed every day on the systems it monitors.

We, the media, stand accused here. We live in an online world where the attention span of the collective masses is so minuscule that most of the people who started reading this story have not got this far.

News is only news in the moment that it breaks for most media outlets. A few tech publications, such as IT Pro, can see beyond the moment and offer more in-depth analysis and insight into important IT-related issues. However, even we have gone pretty cold on Heartbleed.

Yet the threat persists, the threat window remains wide open and the stink that's blowing in really isn't very palatable, if you ask me.

The biggest threat to information security is complacency, history has shown us that over and over again. The Heartbleed vulnerability itself is evidence of this; a programming error in OpenSSL created by a coder who thought he was fixing something and compounded by complacency in the peer review process, which enabled it to go live.

Now enterprises are being complacent, and compounding the original error again by assuming the threat window has been closed because the media has stopped talking about an old exploit.

It's time to start the security conversation again, and time to walk the walk once the talking is done. By this I mean you need to check that encryption keys and certificates have been changed. It's not enough to just apply a patch and think the job's a good 'un.

In a world where the stats suggest 75 per cent of targeted networks are compromised on average within minutes, yet it takes 17 per cent of companies 'many months' to remediate known threats (and more than a year for four per cent), something has to change.

That something is the rate of remediation decay. After an initial post-disclosure spike it tends to (long) tail off very quickly.

I've already berated my own industry for playing a part in this, now it's time to step up and take some responsibility yourselves.

Featured Resources

Modern governance: The how-to guide

Equipping organisations with the right tools for business resilience

Free Download

Cloud operational excellence

Everything you need to know about optimising your cloud operations

Watch now

A buyer’s guide to board management software

Improve your board’s performance

The real world business value of Oracle autonomous data warehouse

Lead with a 417% five-year ROI

Download now

Most Popular

Dell XPS 15 (2021) review: The best just got better

Dell XPS 15 (2021) review: The best just got better

14 Jan 2022
Sony pulls out of MWC 2022
Business operations

Sony pulls out of MWC 2022

14 Jan 2022
Openreach offers £20,000 reward for information on stolen copper cables

Openreach offers £20,000 reward for information on stolen copper cables

21 Jan 2022