Heartbleed remains serious threat to enterprise: Security firm

It is believed to have infected nearly half a million of the Internet’s secure Web servers and just two weeks before the tax filing deadline in April, it forced Canada Revenue Agency (CRA) to shut down its Web site.

The OpenSSL cryptography vulnerability  known as the Heartbleed bug which enables hackers to grab data from from computer systems by just communicating with a host server, caused a widespread scare around the globe just five months ago. Now, after many corporations and government agencies are supposed to patched their systems, a security firm is saying that Heartbleed remains a serious threat.

In a recent report, Venafi Inc., a Salt Lake City-based cyber security software company, said its survey of 1,639 Global 2000 companies that many such firms “have not completely remediated Heartbleed.”

This means as much as 97 per cent of external servers of global 2000 companies remain vulnerable to cyber attacks through Heartbleed.

“Even though many Global 2000 organizations have taken basic steps to remediate Heartbleed, most have not entirely remediated their vulnerability,” the firm said. “Only 387 G2000 organizations have fully remediated Heartbleed.”

Venafi said it also evaluated 550,000 host as part of its Heartbleed scan and found that more than 460,000 host were previously or currently “Heartbleed vulnerable.”

Only 5,000 hosts or three per cent of surveyed G2000 companies have been fully remediated from Heartbleed.

The company also repeated warning by many experts that simply patching the Heartbleed vulnerability is not adequate to protect organizations.

“it is required to also replace the private key, re-issue the certificate and revoke the old certificate,” according to the report. “…Failure to revoke the old certificate enables the attacker to use the old certificate in phishing campaigns against the organization and its customers.”

The company said organization should make sure to:

  • Know where all keys and certificates are located
  • Generate new keys and certificates
  • Revoke old keys and certificates
  • Validate remediation to ensure new keys and certificates are in place.

“The most concerning issue is there is little movement in the number of legacy, pre-Heartbleed certificates being revoked,” according to Venafi.

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Nestor Arellano
Nestor Arellano
Toronto-based journalist specializing in technology and business news. Blogs and tweets on the latest tech trends and gadgets.

Related Tech News

CDN in your inbox

CDN delivers a critical analysis of the competitive landscape detailing both the challenges and opportunities facing solution providers. CDN's email newsletter details the most important news and commentary from the channel.