The Linux security study has been made public. How you patch matters.

Computer security is dependent on the software being kept up to date. Business users and IT departments should be aware of that.

Apparently, it is. Some Linux users don't install patches, critical or otherwise.

A recent survey sponsored by TuxCare shows that companies fail to protect themselves against cyberattacks even when patches exist.

Fifty five percent of respondents had a cybersecurity incident because a patch was not applied. 56 percent of the time, it takes five weeks to one year to patch a critical or high priority vulnerability.

The study wanted to understand how organizations manage security and stability in the Linux suite of products. The Ponemon Institute surveyed IT staffers and security practitioners in 16 different industries in the United States.

Companies take too long to patch security vulnerabilities even when solutions exist. Many of the respondents said that they felt a heavy burden from a wide range of cyberattacks.

The CEO and founder of TuxCare said that this is a fixable issue. The solution does not exist. It is difficult for businesses to prioritize future problems.

The people who build exploit kits have gotten better. TuxCare President Jim Jackson told LinuxInsider that it used to be the best practice to patch for 30 days.

Main food items.

The misconception that the Linux operating system is not perfect without intervention was exposed by the survey results. Users often don't use a firewall. Many of the pathways for intrusion result from vulnerabilities that can be fixed.

Larry Ponemon, chairman and founder of the Poneman Institute, stated that patching is the most important step an organization can take to protect themselves from cyberattacks.

There are vulnerabilities that are not limited to the kernel. He said it needs to extend to other systems.

TuxCare launched its first extended lifecycle support service for CentOS 6.0 in November 2020. It was a huge success right off the bat. He is having trouble with new clients who have not done any patching.

I always ask the same question. What have you been doing for the last year and a half? Nothing? You haven't patched in a year. Do you know how many vulnerabilities have piled up in that time? He joked.

The process is labor intensive.

The issues organizations have with timely patching of vulnerabilities were uncovered by Ponemon. According to Ponemon, an average of $3.5 million annually was spent on weekly monitoring systems for threats and vulnerabilities.

To address this problem, CIOs and IT security leaders need to work with other members of the executive team and board members to ensure security teams have the resources and expertise to detect vulnerabilities, prevent threats, and patch vulnerabilities in a timely manner.

The companies that did patch spent a lot of time in that process.

The figures relate to an IT team of 30 people and a workforce of 12,000 across the respondents.

Excuses are boundless.

Jackson talked to people who repeat the same story. They talk about investing in vulnerability scanning. They look at the vulnerability report. They complain that they don't have enough resources to fix things on the scans.

That is crazy! He said so.

The whack-a-mole syndrome is a challenge companies experience. The problem gets so big that organizations and their senior managers can't handle it.

Jackson likened the situation to trying to protect their homes. A lot of adversaries are potential break-in threats. They are going to look for things in your house.

People invest in an elaborate fence around their property and monitor cameras around the house to keep an eye on everything.

They left a couple of windows open and the back door open. It's like leaving vulnerabilities unpatched. He said that if you patch it, it is no longer exploitable.

He said to get back to the basics. Make sure you do that before spending money on other things.

Patching is made painless by automation.

Jackson says the patching problem is serious. The ability to apply automation is the only thing that is improving.

Any known vulnerability needs to be mitigated within two weeks. People have driven automation for live patching so you can meet tens of thousands of workload. You can't start everything every two weeks. He explained that you need technologies to automate it.

Jackson said the situation is getting better. More people are becoming aware of automation tools.

The services can use the patches without having to bounce them. TuxCare can apply security patches to Maria, Mongo, and other databases while they are running, thanks to database live patching.

You don't have to restart the database server or any of the clients they use. It definitely helps to drive awareness. Jackson said it seems like more people are aware that they need a solution.