A report from PaloAlto Networks coins a new security metric: Mean Time to Inventory in order to highlight the incredible speed with which attackers are now targeting new vulnerabilities as soon as they are publicly disclosed.

The report is based on three month’s monitoring of 50 million IP addresses owned by global enterprises in order to discover how quickly adversaries identify and attempt to exploit vulnerable systems.  The report makes sobering reading for Security Managers, even taking into account the vendor’s desire to highlight the need for their new ‘always on’ vulnerability scanning service called Cortex Xpanse.

What is Mean Time to Inventory?

MTTI is the length of time between a vulnerability being disclosed and attackers scanning for and identifying a vulnerable system in your network. In other words, how long it takes for an attacker to identify your vulnerable system and add it to their inventory of systems to target for exploitation.  From a Security Manager’s perspective, MTTI is the time taken to identify a particular system needs to be patched after a vulnerability is disclosed.

For many businesses, MTTI is measured in days or weeks.  Vulnerability scans may be run once a month, for example, in order to identify systems that require intervention for vulnerabilities not fixed in that month’s security patch bundle.

From the cyber criminal’s perspective however, MTTI is not measured in days or weeks, instead today’s online attackers operate at the speed of hours or even minutes.

According to the report from Palo Alto Networks:

{Malicious} Scanning started 15 minutes after the release of a CVE for a vulnerability that enabled remote access to products from a maker of ‘prosumer’ networking devices. By contrast, we saw large- scale scanning begin just 5 minutes after the high-profile disclosure of Microsoft Exchange Server and Outlook Web Access vulnerabilities {after the 2^nd March publication}.

The reality is, for many organisations today, their vulnerability management systems operate at an order of magnitude slower than those of the attackers. The scanning systems readily available to today’s attackers can scan all 4.3 billion IP addresses on the Internet looking for a vulnerable system in just 45 minutes.

For Security Managers, vulnerability management is just one component of delivering a secure network.  By layering multiple techniques (defence-in-depth) such as network segmentation,  penetration testing, and using secure baseline configurations security can be ‘designed-in’ to the network to help mitigate the risk of unpatched vulnerabilities.