By Hezi Chen, Head of Competitive Intelligence

You assume your security architecture is secure, that’s not always the case

Organizations that provide security understand their products must be secure. Unfortunately, this is not always the case.

A security vulnerability can get baked into an application, and if it does occur, your security partner should act swiftly to resolve the issue. The quick distribution of a patch or effective alternatives are expected.

In 2019, previously unknown vulnerabilities within a security vendor’s system were exploited by a state-backed hacking group. It took a long time for these vulnerabilities to be patched, and two years later, there are still customers running vulnerable systems, leaving their organizations open to cyber attacks.

It continues on, In 2022, with two consecutive CRITICAL vulnerabilities with rating of CVSS 9.3 as binding operational directive and CVSS 9.6 that were actively exploited in the wild as published in CISA (Cyber Security & Infrastructure Security Agency) known exploited vulnerabilities catalog

As a real impact example, that occurred in October 2022, following CVE-2022-40684, the mere fact that such sever vulnerabilities are published as a critical issue and how easy it is to exploit – hackers jumped into the wagon and started to exploit it in the wild….
You can see in the below image the spike in exploitation of this WORLDWIDE… on the day it became public knowledge.

Choose your vendors with the right track record

As highlighted in this incident, your security vendor must have your back. They should be ready to take every action necessary to efficiently provide quality security. Working with a mature, well-known security firm can mean the difference between staying consistently secure with proactive and rapid responses versus suffering from compromised systems.

In yet another example, a massive zero-day security hole was discovered with a major security vendor’s appliances. This exploit was active and used against customers for close to a year. Unfortunately, this is not an isolated incident. Hackers target major security vendors to inflict widespread damage. Here are a few examples of recent security breaches:

When it comes to high severity vulnerabilities, the security vendor you do business with can become a make or break situation to protect your organization. The following charts identity that not all security vendors respond effectively to critical and high severity vulnerabilities.

The long list of those vulnerabilities continues and can be seen of each vendor’s security advisory public web sites.

 

Critical and High Severity Vulnerabilities

In Critical & High Severity, Check Point Software fixes major vulnerabilities up to 30X faster than the competition with up to 99% less high-profile vulnerabilities on its own security solutions.

Overall Security

Generally, security vendors should develop secure products overall and show seriousness in both amount of security vulnerabilities they have in addition to the time it takes to patch, regardless of severity.

Overall, Check Point Software fixes vulnerabilities up to 30X faster than the competition and has up to 88% less vulnerabilities with its own security solutions.

Check Point provides the Infinity architecture that encompasses more than 60 security services and provides services for more than 50 types of assets. Experts can respond to requests in real-time or in under 24 hours.

Be ready to protect against sophisticated attacks

History tells us that almost every new innovative service  loses ground to a “good enough” competitor. As we’ve seen an increase in attacks like Wannacry and NotPetya and more breaches in organizations such as HBO, Equifax and Uber, there’s a pattern. Organizations invested a lot in “good enough” security products, yet they lost the cyber battle. While “good enough” or “2nd best” may be fitting for smartphones or TV’s, it becomes dangerous when this mantra creeps into the cyber security industry.

I believe the single greatest cyber threat to organizations today is the “good enough” proposition  pushed by some key players within the cyber security industry. In order to overcome this mindset, customer organizations need to  ask these hard questions when evaluating their cyber security strategy:

  • Can I afford the risk with “good enough” security?
  • What are the risks specific to my organization?
  • Am doing everything possible to secure my organization and customers, or have I settle for ‘good enough’?
  • What exactly am I getting with my security investments?

Check Point: Best-in-class security

From it’s founding nearly three decades ago, Check Point Software has committed to delivering best-in-class security. This accomplishment embodies what Check Point believes in and has proven with customers and partners and within the security industry. Check Point Software technology includes independent evaluations from Gartner, Forrester, CyberRatings (NSS Labs), MITRE, and more. Your investment in Check Point Software, includes these four points;

1) Real Security – The most important thing in security solution is protection. Security is and has always been Check Point Software’s primary focus in its products and services.

2) Consistent – Check Point Software doesn’t play the “gear up” game to do well with one test then fall off on the next. Each and every day, we build products and support customers and partners with a commitment to provide only the best.

3) Reliable – From firewalls to IPS to NGFW to Advanced Threat Prevention, to Threat Intelligence, machine learning and AI to management, our customers count on Check Point Software for consistent leadership and innovation.

4) Excellence – Check Point Software strives to be the best in every product built, every test joined, every service provided.

 

You may also like