According to Cyber insurance firm Coalition, the average monthly critical Common Vulnerabilities and Exposures (CVEs) in 2023 is expected to be 1,900, a 13% increase from 2022. This prediction is based on data collected from the company's active risk management and reduction technology, which includes data from underwriting and claims, internet scans, its global network of honeypot sensors, and scanning over 5.2 billion IP addresses. The 1,900 CVEs will include 270 high-severity and 155 critical-severity vulnerabilities. The predictions are based on data collected over the last ten years, and it is estimated that most CVEs will be exploited within 90 days of public disclosure, with the majority of exploits taking place within the first 30 days. Coalition's honeypots observed 22,000 cyberattacks to gain an understanding of attackers' techniques. The research also found that 94% of organizations scanned in 2022 had at least one unencrypted service exposed to the internet, and Remote Desktop Protocol was the most commonly scanned protocol. Additionally, Elasticsearch and MongoDB databases were found to have a high rate of compromise, with signals showing that a large number have been captured by ransomware attacks. To prepare for the looming 2023 threats, Coalition recommends that organizations and their security and IT teams prioritize applying updates on public-facing infrastructure and internet-facing software within 30 days of a patch's release and follow regular upgrade cycles to mitigate vulnerabilities in older software. Cybersecurity professionals must also be more alert than ever to vulnerabilities that already exist within their networks and assets. To help with this, Coalition has created a new scoring mechanism for CVEs called the Coalition Exploit Scoring System (CESS). The CESS is designed to provide security researchers and underwriters with two key pieces of information: the likelihood of exploit availability and the likelihood of exploit usage. The goal of the CESS is to create a fully transparent system that explains exactly how the score was reached so that the community can help improve it.
This Cyber News was published on www.csoonline.com. Publication date: Mon, 06 Feb 2023 13:37:02 +0000