Why has the Heartbleed threat window been left wide open?

Six months have passed since news of Heartbleed first emerged, but enterprises don't seem to appreciate the threat it poses still persists

The Heartbleed bug is yesterday's news and no longer something we need to worry about, right? Wrong.

The problem is too many people think this way, which has led to the situation where many enterprises still have machines that are unprotected from the flaw.

Security outfit Venafi probed the Forbes Global 2000 list of companies 10 days ago and discovered more than half - across banking, health and retail sectors - still had devices that were vulnerable. In fact, 1,219 out of the 2,000 companies, and 448,000 potentially vulnerable servers, were detected.

Advertisement - Article continues below

Last week IBM said it sees some 7,000 attempts to exploit Heartbleed every day on the systems it monitors.

We, the media, stand accused here. We live in an online world where the attention span of the collective masses is so minuscule that most of the people who started reading this story have not got this far.

News is only news in the moment that it breaks for most media outlets. A few tech publications, such as IT Pro, can see beyond the moment and offer more in-depth analysis and insight into important IT-related issues. However, even we have gone pretty cold on Heartbleed.

Yet the threat persists, the threat window remains wide open and the stink that's blowing in really isn't very palatable, if you ask me.

Advertisement - Article continues below

The biggest threat to information security is complacency, history has shown us that over and over again. The Heartbleed vulnerability itself is evidence of this; a programming error in OpenSSL created by a coder who thought he was fixing something and compounded by complacency in the peer review process, which enabled it to go live.

Advertisement - Article continues below

Now enterprises are being complacent, and compounding the original error again by assuming the threat window has been closed because the media has stopped talking about an old exploit.

It's time to start the security conversation again, and time to walk the walk once the talking is done. By this I mean you need to check that encryption keys and certificates have been changed. It's not enough to just apply a patch and think the job's a good 'un.

In a world where the stats suggest 75 per cent of targeted networks are compromised on average within minutes, yet it takes 17 per cent of companies 'many months' to remediate known threats (and more than a year for four per cent), something has to change.

That something is the rate of remediation decay. After an initial post-disclosure spike it tends to (long) tail off very quickly.

I've already berated my own industry for playing a part in this, now it's time to step up and take some responsibility yourselves.

Featured Resources

The case for a marketing content hub

Transform your digital marketing to deliver customer expectations

Download now

Fast, flexible and compliant e-signatures for global businesses

Be at the forefront of digital transformation with electronic signatures

Download now

Why CEOS should care about the move to SAP S/4HANA

And how they can accelerate business value

Download now

IT faces new security challenges in the wake of COVID-19

Beat the crisis by learning how to secure your network

Download now



K2View innovates in data management with new encryption patent

28 May 2020
video conferencing

Zoom 5.0 adds 256-bit encryption to address security concerns

23 Apr 2020

WhatsApp flaw leaves users open to 'shoulder surfing' attacks

21 Apr 2020
cyber security

Microsoft AI can detect security flaws with 99% accuracy

20 Apr 2020

Most Popular

Microsoft Windows

Microsoft warns users not to install Windows 10's May update

28 May 2020
Server & storage

Dell EMC PowerEdge R7525 review: An EPYC core density to make Intel weep

26 May 2020
Network & Internet

Intel releases Wi-Fi and Bluetooth driver updates for Windows 10

26 May 2020