The difference between a software bug and a software vulnerability is the type, and typically the amount, of harm that it can cause. A bug refers to an error that results in software performing in a manner not planned by its programmer. This could be anything from an error message flashing up on screen to an application crashing to a control flow error, in which the “flow” of using a piece of software (such as clicking “save” and being presented with the option of typing a filename) does not proceed in the expected order. Bugs can be annoying or even, on occasion, disastrous to the success of a piece of software. What they do not do is open up the software application to exploitation by a third-party attacker.
A software flaw that does this is what is referred to as a vulnerability. As its name implies, a vulnerability is a flaw that exists with a piece of software that can be exploited for malicious use by an attacker. Vulnerabilities are typically not immediately obvious, but instead require a degree of ingenuity in order to be exploited. This can make them difficult to spot immediately, and makes the race to discover them a competition between those who want to patch them and those who wish to use them to inflict damage.
While vulnerabilities aren’t necessarily easy to find, however, they are far from rare. In 2020, more than 23,000 new vulnerabilities were discovered. That is more than the total number discovered in 2019, continuing a general upward trend in the number of vulnerabilities found each year.
It’s a reminder of why tools like web application and API protection matter in a big way.
Server security vulnerabilities
Vulnerabilities can strike anywhere. Some targets are more sought after than others, though. One of these is web servers. There are a number of ways attackers may target web server vulnerabilities. Common attacks include SQL injections (a type of code injection attack in which bad SQL statements are injected into entry fields), cross-site scripting (XSS) attacks (in which attackers, looking to bypass access controls, can insert client-side scripts into webpages), cross-site request forgery (which lets attackers to induce users to carry out actions that they do not authorize), and more. The results of these attacks can be severe, including stolen data or hacked authorization.
There have been some notable examples of server vulnerabilities. For example, this year there were highly publicized vulnerabilities involving Microsoft Exchange Server vulnerabilities ProxyToken and ProxyShell. These could be used to allow attackers to carry arbitrary code execution on Exchange Servers.
Unfortunately, while everyone is aware of the risk that server vulnerabilities can pose, companies can be slow to patch critical server vulnerabilities. One recent report claimed that 50 percent of servers possess weak security posture, with patching complicated as a result of environments that are becoming increasingly complex all the time. Organizations frequently fail to patch servers in a timely way, use older protocols, and run unsupported software. Things have become even more challenging during the pandemic, as “work from home” measures have become standard — with more employees than ever operating in a globally distributed manner.
The right tools for the job
Despite these challenges, it’s crucial that businesses and other organizations employ strong patch management strategies. Delays in installing patches can leave systems in incredibly vulnerable positions. Cyber criminals don’t stop attempts to take advantage of vulnerabilities the moment a patch is issued. If anything, they can use security patches to spot vulnerabilities which they can then harness to attack any unpatched — and therefore unprotected — systems. Organizations must do whatever they can to deploy patches, prioritizing the most serious vulnerabilities.
Luckily, there are tools which can help keep systems safe. Tools such as web application firewalls (WAFs) and web application and API protection (WAAP) can help safeguard web applications and APIs alike across a broad gamut of potential attacks. Next-generation WAFs monitor web applications using smart behavioral analytics and AI to identify and block attacks, even when they don’t conform to predictable patterns. Meanwhile, they can also help protect against account takeovers, distributed denial of service (DDoS) attacks, and far more. They are vital for protecting unpatched server software.
The threat of vulnerability seeking attackers is not going to go away any time soon. Cyber security is a cat-and-mouse game in which experts on both sides constantly look for ways to stay one step ahead of their rivals — whether those rivals are developers looking out for their customers or attackers looking for ways to exploit vulnerabilities. In this environment, organizations need all the help they can get to keep safe.
Making sure that you equip yourself with the latest cyber security protective measures is one of the smartest moves you can make. The vulnerability problem, and complexity of the patching landscape, is only going to increase. Use every tool at your disposal to keep yourself and your customers free from problems.