Vulnerable, hidden software is on the rise.
The well-intentioned employee is the driving factor of hidden software. Often, it’s to do a simple or sometimes even a single task! Software that is installed by an employee which is not known or approved of by the IT Department is called Shadow IT. Because of Shadow IT, the organization is left exposed with a variety of unknown wider consequences.
Additionally, unapproved software is often built from popular open source and third-party code – the building blocks for software development. In fact, very well-known vulnerabilities remain hidden as components in the software supply chain. They manifest themselves in applications without the knowledge of IT. This increases the attack surface and makes patching a game of hide-and-seek.
Software is vulnerable. But, having vulnerable software that you don’t even know about leaves an organization exposed.
Recent studies by BSA The Software Alliance, have shown there’s nearly a one-in-three chance of encountering malware of some kind with installed, unlicensed software. Yet businesses lack the visibility to what software is running across their entire estate – good or bad.
Without a formal process in place, many organizations allow employees to have free reign over their device environment. They have the ability to freely download software at will. Any software downloaded to a device provides instant exposure to the wider network. A major cause of data breaches is due to unlicensed software. IT organizations need to take back power when it comes to controlling installed software across the network. They need to know the software installed on ALL systems and devices and importantly remediate at speed.
Unfortunately, without taking the appropriate steps, it is only a matter of time before the next headline-grabbing breach.
2017 left Equifax reeling after their (very public) breach. It took a long time to uncover how deep the rabbit hole of their breach went. 146.6 million personal records stolen along with highly sensitive information compromised. Equifax blamed the breach on a single human error with failure to communicate the roll out a patch to the known open source breach of Apache Struts or CVE-2017-5638. Even if the patch had taken place it would only have patched known instances of the installed software.
If you want to reduce exposure to threat, complete trust and visibility into your entire software estate are crucial.
Failure to meet these demands is costing businesses millions of dollars.
1E has the unique ability to help organizations take back control of their IT estate. They empower companies to be pro-active in fighting against exposure from risks including unauthorized or unlicensed IT. As 99% of cyber-breaches use known vulnerabilities in software running in an organization (*Gartner), it is essential to know all the software running, no matter its location. 1E finds and normalizes millions of executables into manageable information via an extensive software catalog and extended databases including the National Vulnerability Database (NVD) which most IT and security personnel are familiar with. 1E automates upgrades, ensuring your OS and applications and patches are always current with minimal effort. Most importantly, 1E allows organizations to successfully hunt for indicators of compromise and respond to incidents at network speed before they become breaches.
