Thousands of internet-connected databases contain high or critical CVEs, says report by cloud security biz

After spending five years poring over port scan results, infosec firm Imperva reckons there's about 12,000 vulnerability-containing databases accessible through the internet. The study also found that of the 46 per cent of 27,000 databases scanned, just over half that number contained "high" or "critical" vulns as defined by …

[elsergiovolador]

Think of the databases

Given the authoritarianism is no longer something that is frowned upon by the current elites, and that they like to use fear and security as an excuse to advance the agenda of total control, it's not a far fetched idea that in not so distant future only the government will be allowed to run databases.

This means your tech company will have to apply for a database, state its purpose, what kind of data it is going to hold in and what RDMS system will be required and so on. Then company will get the keys and will be able to store e.g. customer data in a "secure" database to "protect" citizens, but everything will be looked after by dedicated agency and government will be able to see what the population is up to.

[Wellyboot]

Re: Think of the databases

Just to be clear, are you using the term 'elites' as a description for the self aggrandizing power hungry numpties and hangers on that we get to choose between at election time or the self aggrandizing power hungry numpties and hangers on that run big tech?

[elsergiovolador]

Re: Think of the databases

I mean both. They are intertwined. I am sure any of big tech companies would love to run such project - it will keep competition at bay, it will get extra revenue - possibly an opportunity for politicians to use tax payer money to subsidise those databases for "startups" and getting PR, they will have leverage when it comes to avoiding paying taxes (we know we don't pay tax, but we can also turn the lights off and what you gonna do?), more data to train AI... the list of mutual benefits is probably endless...

[noisy_typist]

Port scan results

So the universe if databases they have results for is those with an open and scannable port facing the internet... I would expect a basic security procedure in almost all cases would be to not do this.

So out of the set of databases exposed directly to the internet, just under half have critical vulnerabilities. I am surprised it's not higher.

[simkin]

Re: Port scan results

Seriously. The fact that a database is exposed to the Internet at all is a critical vulnerability.

[JimboSmith]

Re: Port scan results

A CTO I heard giving a speech said that it was important to remember that despite all the buzz about 'the cloud'........."That's still just somebody else's computer permanently connected to the internet."

[Warm Braw]

On-premises databases tend to be more vulnerable

They seem to have a Cloud Data Security product nevertheless.

Bring back the good old days when a basement, a filing cabinet and a leopard (or threat thereof) was all you needed.

[stiine]

Re: On-premises databases tend to be more vulnerable

Ah, but you're forgetting the missing staircase and illumination, and the possible leopard.

[Steve Davies 3]

Duh!

Quote

"Erez's company sells cloud security products,"

Says it all really... It is in his companies interest to get YOUR data into the Cloud that THEY control.

[Anonymous Coward]

Re: Duh!

They also sell on-prem hardware and software which means its in his company's interest for you to keep your data in your own datacenters.

[rcxb1]

Naievely matching version strings

These types of scans / surveys just connect to an open port and read the version string. They have no idea whether they're hitting lots of honey-pots, version strings being spoofed, or old services that have been patched for vulns but not entirely upgraded to a newer version of the product...

Of course they know they're getting a lot of nonsense, but they're happy as it helps their product pitch if they find large numbers that make good headlines, and reporters don't actually bother asking questions these days.

[Anonymous Coward]

Re: Naievely matching version strings

That might be true. I've found that Nessus thinks some current BSD based devices are PCs running Windows Vista... Every month we have to dispute this.

On the other hand, any apache version that hasn't been supported since CentOS 5 is probably a good indicator that something's quite out of date.

[Anonymous Coward]

"Put your data on someone else's computer to keep it safe, urges Imperva"

That just shifts some of the blame onto someone else... you probably still set the wrong access permissions and they probably still forget to apply all the patches in a timely manner

As pointed out above... "That's still just somebody else's computer permanently connected to the internet."

[Anonymous Coward]

We will continue to be at risk while the industry hires people with worthless money making certifications like CEH instead of the people who have grown up reverse engineering electronic devices or finding back doors in software protection.

Its time big business woke up to the fact that these pointless, out of date and irrelevant certifications do not magically turn someone who has seen a few episodes of spooks in to a l33t h4><Or, they churn out people who think running a fifteen year old exploit against DVWA is how vulnerabilities are found and exploited.

Oh, and can we please stop using the term 'threat actor'. It makes the person using the term sound like a d***.