USING WHAT WORKS

“ Cybercriminals have continued to make widespread use of vulnerabilities in legitimate software to launch malware attacks.  They do this using exploits—fragments of code designed to use a vulnerability in a program to install malware on a victim’s computer without the need for any user interaction.  This exploit code may be embedded in a specially-crafted e-mail attachment, or it may target a vulnerability in the browser.  The exploit acts as a loader for the malware the cybercriminal wishes to install. . . . Cybercriminals focus their attention on applications that are widely-used and are likely to remain unpatched for the longest time—giving them a large window of opportunity through which to achieve their goals.  In 2013, Java vulnerabilities accounted for around 90.52% of attacks . . . .  This follows an established trend and isn’t surprising.  Java is not only installed on a huge number of computers (3 billion, according to Oracle), but its updates are not installed automatically. . . . To reduce their ‘attack surface’, businesses must ensure that they run the latest versions of all software used in the company, apply security updates as they become available and remove software that is no longer needed in the organization. ” (pp. 17–18)