Why Your Patch Window Is a Security Liability | Tuukka Tiainen, Recast Software | TFiR

Swapnil Bhartiya: Somewhere in your calendar there is a patch window. It comes once a month, maybe once a quarter. That rhythm was built for a trickle and that trickle predates AI. This year the trickle has become a flood because now AI helps vendors find and fix flaws faster than ever. The vulnerability that is most likely to hurt you already has a patch. But that patch is waiting for your next patch window. And this gap is what attracts attackers. And today we have with us Tuka the Aynan Dikast lead security engineer to unpack it all. First of all, Tuka, it’s great to have you on the show.

Tuukka Tiainen: Thank you very much. Yeah, this is a really interesting topic.

Swapnil Bhartiya: Yeah, let’s look at, I mean we are going to look at the numbers, all the data that you presented before that. I would love to know a bit about the company and your own background so our audience know who they are listening to.

Tuukka Tiainen: Recast Software is the company I represent here. We have our own products for basically managing endpoints. So either it is patching or monitoring them or whatever or privileged access. We have those. So everything that we do basically have something to do with endpoints. And I especially, I mean like workstations, Windows machines and Macs. So those are the products. And I have been here at Recast Software for six years now I think and I have a background in IT. But then at some point I really got more interested in cybersecurity and I’m on that road now.

Swapnil Bhartiya: Now you came up with of course all these numbers, the data and you know how AI is. I mean of course AI is touching security in almost every aspect. It depends on which side of the aisle you are on. So it could be good or bad, but you know, it’s going to be here, it’s not going to go away. So we have to learn how to deal with it. Right. That is the situation. So let’s look at some of the numbers, some of the data, how it has changed things, especially around March this year. What is your assessment?

Tuukka Tiainen: Yeah, well bluntly said there are spikes on those metrics and I have been doing this kind of monthly block for over two years now. And I have to say that most of the months have been like last year and a year before that. They seemed pretty static. Sure there were like more zero day exploits, some months and the numbers were different. But this spring, like you said in March, the metrics really started to become different. I mean only the number of vulnerabilities patched every month. It went up a lot and we are getting this data from our own because we have our own solution, our own product application workspace and we have our so called application catalog that and we are tracking a whole lot of different vendors and how they release patches and all about their new version. So yes, there was a spike and it hasn’t come down since.

Swapnil Bhartiya: As I was saying in the very beginning that now vendors are finding and patching more vulnerabilities than ever. It is quite obvious that AI is helping in vulnerability discovery. But is that also one of the reason for this spike or there’s some other reasons?

Tuukka Tiainen: Well, that is my strong suspicion that AI is behind this. We especially the bigger browsers, Chromium and Firefox, I can see especially in those applications there are so many vulnerabilities starting to appear. So I would really think that it’s Mythos or some other AI technology frontier technology behind that. And for example Mozilla, they admit that they have enhanced their own vulnerability management harness with AI. So we have proof from there and I think it’s same with the Chromium as well. I mean all you need to do is look at the release notes and the list of the vulnerabilities and the contributions in their release notes and you can see AI there and so much more of those vulnerabilities. And overall. So AI definitely is there one of the reasons.

Swapnil Bhartiya: Now as we all know that AI is getting better and you also gave example of methods and all those models there. It is getting better at finding vulnerabilities and it could also help attackers exploit them. How does that change the vulnerability and patching landscape especially for companies like Recast where you do help customers, users in patching those vulnerabilities that are found. So talk about how is it changing landscape for the whole market and even for you.

Tuukka Tiainen: That’s a very good question I think for me as well because I can talk for myself. I do the patch management internally at Recast but then also for our customers. I mean it used to be those zero day exploits that were felt the most dangerous thing out there. Whenever they are you had to really go fast and patch them. But now when there’s AI, when malicious actors, criminals are using AI as well, they are so easily, they can reverse engineer these patches and even vulnerabilities that seem to have low severity with the help of AI people and malicious actors they can change these exploits and therefore it’s just you need to be patching this application faster than you used to do. It’s kind of simple if you put it that way.

Swapnil Bhartiya: Let’s come back to the gap that we talk about. How would you define what exactly is patch gap to security teams and users? And why do you feel or believe that it could become one of the most important metrics when it comes to vulnerability management? Because that is the window when things go wrong.

Tuukka Tiainen: Yeah, I mean, it depends if you think this from the perspective of a malicious actor learning or creating an exploit. But let’s say there’s an exploit and then your organization has to, you have to know about that. You have that software, you have to know that that’s vulnerable. So you have to know the versions. But then you need to obviously patch into the latest version. That would fix the exploit. And that’s the time gap there, which I think that it’s going to shrink because malicious actors will get their, they will create those exploits so fast. So that’s the critical time there between the exploit happening and then you having your latest version on your machines, on your fleet of machines.

Swapnil Bhartiya: Do you think that three days is enough time or too much time or too little time? No, it depends on who you’re talking to. For a lot of teams who have to prepare for the patching because they have to worry about things that should not break, patching can, we have seen so many examples, the critical systems may break, so at one point it’s not enough time. And also when if it is dropped on Friday and now you’re working on Saturday, Sunday and Monday at the same time, three days may be a lot of time for bad actors. So how do you look at this window?

Tuukka Tiainen: If we think about this from purely from security point of view, I would always prioritize that, do the patching faster. But I know that in larger organizations you might need to actually test those new application versions or operating system versions before you actually deploy them in your own environment. But that is just my gut feeling right now that we might need to give up some of that testing. That might seem critical for usability and availability. But I think the security just weighs more in the scale here, if you know what I mean.

Swapnil Bhartiya: Now, if organizations may need to patch critical vulnerabilities within these three days, what has to change about how IT and security prioritize and manage patching? Because this is the window, there may be a long CVE list now they don’t know what to prioritize, what not to prioritize.

Tuukka Tiainen: That’s always a difficult question because I know that many companies have relied for example on the CVSS scoring in the past, but I don’t think that that metric alone is reliable enough anymore because there are things available, for example EPSS that tells about how likely a vulnerability is going to be exploited within the next 30 days. So I would rely much on that, but also on other metrics like there are threat insights like maybe is it part of a tool, is the exploitation public, and all that kind of stuff we need to be looking at. So CVSS for example it’s not enough anymore. You need to look at the exploitability as well and rely on other metrics. Maybe that will help with the prioritization.

Swapnil Bhartiya: And how do you help organizations either with the priorities or to get the patch in time? Also actually look, the problem with the patch is that patch is there. If you don’t deploy the patch, what good is the patch?

Tuukka Tiainen: Well, first of all, I know at least one way we are able to help with this. I’ve noticed when I’ve used quite a bit of different vulnerability databases and then I’ve used our own product and I know for a fact that we deliver those patches pretty fast and there are different ways of doing this. But if you know, if you are reactive, you look for the vulnerabilities first. It might be a little late for you when you start patching, only when you know about the vulnerability. But you can be proactive as well. You can use a tool that you keep, you kind of take the, you maintain the lifecycle of the application and you deploy the new version whenever there’s a version available. You don’t need to wait for the signal for the vulnerability. You know, you can start patching it whenever there’s the latest version. So that’s at least something. We delivered those new application versions really fast.

Swapnil Bhartiya: This is a kind of interesting question. Where we may give credit to AI or take credit from AI is that when we look at these flaws, when we look at the spike that you talked about, were those flaws always there and AI is now capable of finding them or because of AI written code, there are more flaws being introduced. So what I’m looking at is that the flaws were always there but you know, there is a saying, as Linus once said, your fellow Finnish, that given enough eyeballs all bugs are shallow, then there’s a lamp post effect. You know, sometimes you’re only looking where you expect the flaw to be. But flaws can be anywhere else. AI is now capable of doing scanning at a much faster pace. So the question is were the flaws always there and AI is simply better at finding them faster, or because of the way we are writing software using AI there are more flaws. So it’s a tricky question.

Tuukka Tiainen: I think personally that AI just enhances the capabilities of finding those flaws in software. That’s how I think and how I see that’s the reason. Now only some vendors, I mean let’s think about Project Naptime. Only a specific set of vendors and big companies are able to use the best technology out there. So we are only seeing I think like a first wave. They are able to enhance their capabilities finding these flaws and stop them becoming vulnerabilities. But yeah, so I think that exactly that’s the reason AI just makes it easier.

Swapnil Bhartiya: Can you also talk about your team, you have solutions that help, but what kind of internal processes and practices should organizations put in place so that first of all irrespective of how much gap they get, three days, four days, one day, they are ready for those patches. There is no shocking moment. They don’t feel that they were not prepared and both things can happen. They did not apply the patch so they got compromised. Or they applied the patch without testing and they got compromised.

Tuukka Tiainen: There’s no right answer to that. I believe it is just trying to balance between security and availability. But my background is in security. It used to be in IT too but nowadays I would prioritize the security as much as you can and try to find the right processes that you just have enough testing that the availability stays good and not everything breaks. I mean the way I’ve seen third party applications that we focus on, I don’t see so much of them breaking systems completely anymore. Maybe it happens every now and then and testing is needed but make the window as small as you can and have a team to look at these vulnerabilities. That’s the main thing here. You have to have the visibility and you have to know your software inventory. What do you have? Because if you don’t know that, you don’t even know that you are vulnerable to some of these nasty exploits. And start from somewhere. It doesn’t have to be perfect because processes they do develop over time.

Swapnil Bhartiya: Who should reach out to you folks and when and what is the best way to do so? Do you do a lot of hand holding or you just offer, hey, these are solutions, the patch is there. I want to understand how organizations can get the help that they need in time.

Tuukka Tiainen: Yeah, I mean, they can do a lot internally, but we can help. Our solutions can definitely help. I’m not the salesman here, but surely they are able to find our products. They can be the technology that helps here. But even as important is what you can do internally in organizations. Have your team and somebody look at it. Make somebody accountable of patching and vulnerability management. But yeah, we can help with the technology.

Swapnil Bhartiya: Tuukka, thank you so much. I really enjoyed digging into this data with you. And also how, I mean, I really love that you said the flaws were there, AI just speeding up the finding because sometimes we put a lot of blame on AI. It is there and then very pragmatic, very practical approach. So thank you so much and I would love to have you back on the show. Thank you.

Tuukka Tiainen: Yeah, thank you very much. Pleasure.

Swapnil Bhartiya: It was my pleasure. And those who are watching, please go and check more about Recast Software at recastsoftware.com and I’ll see you in the next one. Thank you.