NCSC Warns of ‘Vulnerability Patch Wave’ Driven by AI

According to NCSC, all organizations, whether they are customers and operators or technology manufacturers and vendors, have “technical debt,” which is a backlog of costly and time-consuming technical problems brought on by putting short-term profits ahead of creating robust goods.

Artificial intelligence is demonstrating the capacity to take advantage of this technical debt at scale and speed throughout the technology ecosystem when employed by properly qualified and trained humans. In order to address this technical debt across all software types—open source, commercial, proprietary, and software as a service—the NCSC anticipates a “forced correction.”

For this reason, we are urging all organizations to get ready for the “patch wave,” which is a surge of software upgrades that must be implemented throughout the technology stack in order to fix newly discovered vulnerabilities.

Whitehouse wrote:

“All organizations have ‘technical debt’; a backlog of technical issues – that is both expensive and time-consuming – as a result of prioritising short-term gains over building resilient products. Artificial Intelligence, when used by sufficiently-skilled and knowledgeable individuals, is showing the ability to exploit this technical debt at scale and at pace across the technology ecosystem.” 

Give exterior assault surfaces priority.

As quickly as feasible, all organizations must identify and reduce the attack surfaces that are exposed to the internet and other external threats. As we’ve long said, you should start with the technologies on your perimeter before moving inward to include cloud instances and on-premises settings. By doing this, companies can lower the risk that latent vulnerabilities present when attackers discover and take advantage of them.

Organizations should give priority to updating their external attack surfaces when they are unable to apply updates throughout their whole environment. Organizations should give priority to important security systems whose capacity exceeds the external attack surface.

Whitehouse also added:

“We are expecting an influx of updates to address vulnerabilities across all severities, and expect a number to be critical. All organizations must take steps to identify and minimise their internet-facing (and other externally-exposed) attack surfaces as soon as is possible.” 

Organizations must also understand that patching won’t always be enough; some technological debt may exist in “end of life” or legacy technology that isn’t supported and can’t be updated. In these situations, organizations will have to either replace the technology or put it back under support, particularly if it creates a surface for external attacks.

Get ready to patch rapidly, frequently, and extensively.

Building on the ideas included in our Vulnerability Management guidelines, companies should plan to implement software security updates more rapidly, often, and widely, including throughout their supply chains. We anticipate a flood of updates to fix vulnerabilities of various kinds, some of which will be critical.

The NCSC advises:

• Enabling automatic secure “hot patching”—that is, patching without interfering with service—should be a top priority when it is available.
• To lessen the strain for support staff, automatic updates should be enabled wherever they are available, especially for embedded devices.
• Organizations must make sure that procedures and risk appetites allow for regular and scaled-updating in situations where neither of the aforementioned are available, taking into account the operational trade-offs regarding interruption and safety-critical systems. Installing the patches can be prioritized using a risk-prioritized method like the Stakeholder Specific Vulnerability Categorization (SSVC) scheme.

However, it is crucial to expedite the update process if a significant vulnerability is being actively exploited, particularly if it affects a system that is connected to the internet. For additional information, organizations can consult the NCSC’s updated guidance on “Responding to active exploitation of vulnerabilities.”

In summary, you should implement a policy to “update by default,” meaning that software updates should always be applied as quickly as possible—ideally automatically. Although we acknowledge that it could not be applicable in some situations (such as for safety-critical systems or operational technologies), this need to be the foundation of your update management procedure.

Beyond software upgrades

The systemic issues that my earlier blogs have discussed cannot be resolved by patching alone. I’ve urged technology manufacturers and suppliers to use memory safety and containment methods like CHERI and others when suitable in order to minimize systemic technological security debt.

In a similar vein, consumers and operators should prioritize learning the principles of cyber security in order to increase resilience and lessen the effect of breaches. For businesses running vital services (including energy, healthcare, transportation, digital infrastructure, and government), this entails embracing and fully implementing Cyber Essentials, or the Cyber Assessment Framework.

Additionally, the NCSC has recently released guidelines for organizations experiencing elevated threats on:

• Workstations with privileged access (PAWs)
• Cross-domain strategy and design
• Threat hunting and observability for cyber resilience

Get ready for the patch wave right now.

The NCSC concludes by advising all organizations, regardless of size, to organize and get ready for the vulnerability patch wave. Reading the most recent Vulnerability Management guidelines from the NCSC is a fantastic place to start. In order for larger organizations to be ready to handle any necessary response, we also advise trying to obtain assurance from your commercial and open source supply chains.