Why has the Heartbleed threat window been left wide open?

Six months have passed since news of Heartbleed first emerged, but enterprises don't seem to appreciate the threat it poses still persists

The Heartbleed bug is yesterday's news and no longer something we need to worry about, right? Wrong.

The problem is too many people think this way, which has led to the situation where many enterprises still have machines that are unprotected from the flaw.

Security outfit Venafi probed the Forbes Global 2000 list of companies 10 days ago and discovered more than half - across banking, health and retail sectors - still had devices that were vulnerable. In fact, 1,219 out of the 2,000 companies, and 448,000 potentially vulnerable servers, were detected.

Last week IBM said it sees some 7,000 attempts to exploit Heartbleed every day on the systems it monitors.

Advertisement - Article continues below
Advertisement - Article continues below

We, the media, stand accused here. We live in an online world where the attention span of the collective masses is so minuscule that most of the people who started reading this story have not got this far.

News is only news in the moment that it breaks for most media outlets. A few tech publications, such as IT Pro, can see beyond the moment and offer more in-depth analysis and insight into important IT-related issues. However, even we have gone pretty cold on Heartbleed.

Yet the threat persists, the threat window remains wide open and the stink that's blowing in really isn't very palatable, if you ask me.

The biggest threat to information security is complacency, history has shown us that over and over again. The Heartbleed vulnerability itself is evidence of this; a programming error in OpenSSL created by a coder who thought he was fixing something and compounded by complacency in the peer review process, which enabled it to go live.

Now enterprises are being complacent, and compounding the original error again by assuming the threat window has been closed because the media has stopped talking about an old exploit.

It's time to start the security conversation again, and time to walk the walk once the talking is done. By this I mean you need to check that encryption keys and certificates have been changed. It's not enough to just apply a patch and think the job's a good 'un.

Advertisement - Article continues below

In a world where the stats suggest 75 per cent of targeted networks are compromised on average within minutes, yet it takes 17 per cent of companies 'many months' to remediate known threats (and more than a year for four per cent), something has to change.

That something is the rate of remediation decay. After an initial post-disclosure spike it tends to (long) tail off very quickly.

I've already berated my own industry for playing a part in this, now it's time to step up and take some responsibility yourselves.

Featured Resources

What you need to know about migrating to SAP S/4HANA

Factors to assess how and when to begin migration

Download now

Your enterprise cloud solutions guide

Infrastructure designed to meet your company's IT needs for next-generation cloud applications

Download now

Testing for compliance just became easier

How you can use technology to ensure compliance in your organisation

Download now

Best practices for implementing security awareness training

How to develop a security awareness programme that will actually change behaviour

Download now


internet security

Avast and AVG extensions pulled from Chrome

19 Dec 2019

Google confirms Android cameras can be hijacked to spy on you

20 Nov 2019

Most Popular

data governance

Brexit security talks under threat after UK accused of illegally copying Schengen data

10 Jan 2020
cyber security

If not passwords then what?

8 Jan 2020
Policy & legislation

GDPR and Brexit: How will one affect the other?

9 Jan 2020
web browser

What is HTTP error 503 and how do you fix it?

7 Jan 2020