# Topic 3: Unpatched Software A **software patch** is an update designed to fix bugs, resolve performance issues, or repair security vulnerabilities in a software program or operating system. **Unpatched software** refers to systems or applications that have not had these critical security fixes installed, leaving known security holes open for exploitation. --- ## The Lifecycle of a Vulnerability (Common Vulnerabilities and Exposures - CVEs) To understand the risk of unpatched software, you must understand how vulnerabilities are handled: ![[image-4 2.png]] 1. **Discovery**: A security researcher or vendor discovers a vulnerability. 2. **Patching**: The vendor releases a security patch. 3. **CVE Listing**: The flaw is logged in the public **Common Vulnerabilities and Exposures (CVE)** database, outlining exactly what the bug is. 4. **The Race**: Once a CVE is public, threat actors write scripts (exploits) to target systems that haven't installed the patch yet. --- ## ⚠️ Risks in the Development Environment Unpatched software is highly dangerous in a developer's workflow: * **Vulnerable Development Frameworks**: Web servers (like Apache, Nginx), runtimes (like Node.js, Python), or libraries used to run and test apps locally might contain known vulnerabilities. * **Outdated IDEs and Local Tools**: Text editors, compiler tools, and database clients can be exploited to gain remote control over a developer's workstation. * **Targeted Exploits**: Hackers scan networks looking for unpatched systems. Staging and development servers are often neglected when security teams patch production servers. --- ## Real-World Case Study: The Equifax Data Breach (2017) > [!CAUTION] > **What Happened**: In 2017, Equifax—one of the largest credit reporting agencies in the world—suffered a massive cyber security incident that exposed the highly sensitive credit histories and personal details of over 147 million people. > > **The Vulnerability**: Equifax ran a dispute portal using **Apache Struts**, a popular open-source Java framework. In March 2017, a critical vulnerability (CVE-2017-5638) was discovered in Apache Struts, allowing attackers to execute commands remotely on the server. The vendor immediately released a patch. > > **The Failure**: Equifax's IT department failed to apply the patch. Two months later, attackers scanned the network, found the unpatched Apache Struts server, and successfully breached their database. --- ## Mitigation Strategies & Controls Managing software patches requires a systematic, automated strategy: ### Software Controls (Technical) * **Automated Patch Management**: Use software (such as Windows Server Update Services - WSUS, or Jamf) to automatically download and distribute patches across all employee computers and servers. * **Vulnerability Scanners**: Run automated tools (like Nessus or OpenVAS) to scan local development environments and network servers for unpatched systems and report outdated software. * **Dependency Checkers**: Integrate tools like **Dependabot** or npm audits in code repositories to alert developers when third-party software packages require security patches. ### Administrative Controls (Organisational) * **Patch Management Policy**: Implement a strict organizational policy specifying timelines for applying updates (e.g., "Critical security patches must be applied within 48 hours of release"). * **Asset Inventory**: Keep an up-to-date registry of all hardware and software tools used across the company. You cannot patch software if you do not know it is running on your network. --- ## VCE Exam Practice ### Scenario *ByteSize* is a software house that hosts its developer test environment on a local Linux server. Due to concerns that updates might break their testing tools, the development team has blocked automatic updates and has not patched the server's operating system in two years. A hacker scans ByteSize's network, identifies a known vulnerability in the outdated Linux kernel, exploits it, and gains root administrative access to the server, deleting all test databases. ### Questions 1. **Define** the term 'software patch' in a cybersecurity context. *(1 mark)* 2. **Explain** the security risk ByteSize took by disabling OS updates in their testing environment. *(2 marks)* 3. **Propose** one software control and one administrative control that would resolve the vulnerability of unpatched software at ByteSize. *(2 marks)* --- > [!NOTE] > **Suggested Answers:** > 1. *A software patch is an update released by software developers to fix security vulnerabilities, repair bugs, or improve functionality in an application or OS.* > 2. *By disabling updates, ByteSize left known security vulnerabilities unpatched. The risk is that threat actors can easily identify these publicly documented flaws (CVEs) and use pre-written exploit scripts to gain unauthorized access, execute remote code, or destroy data.* > 3. * **Software Control**: Implement automated vulnerability scanning to scan the server monthly and report outdated software. > * **Administrative Control**: Create a Patch Management Policy that mandates monthly updates for all non-production and testing environments, ensuring security is maintained without ignoring the developers' concerns.*