The recent discovery of a long-standing critical flaw in the Linux kernel has potentially left millions of end-users vulnerable to a cyber-attack. While the discovery of the flaw was recent, it turns out the vulnerability has actually been present in the code since as early as 2012. This means that for approximately 4 years, attackers have had the ability to gain privileges on affected devices. This serves as another candid reminder of the critical importance of a quality cyber security incident response strategy.
The number of devices that could potentially be impacted by this recent flaw could stretch into the tens of millions, since it affects any operating system that has Linux kernel 3.8 or higher, including both 32-bit as well as 64-bit. Of even greater concern, however, is that it also affects Android versions KitKat and above, which indicates that nearly 66% of all Android devices are currently exposed to the critical flaw.
So, what, exactly is the impact of the newly discovered zero-day Linux flaw? Well, for starters, local access on any Linux server is all that a would-be attacker would need in order to exploit the problem. If successful, the attacker would be able to gain root access to the end-user’s operating system, enabling them to view private information, delete files and install additional malicious applications.
One of the reasons this breach is so newsworthy is because flaws in Linux kernel are typically patched immediately upon detection. For this reason, Linux-based operating systems have long been considered to be among the most secure. The zero-day vulnerability has been present for almost 4 years, leaving any individual or business that uses a Linux server exposed to potential cyber-attacks.
The good news is, the Linux team is now aware of the issue and has made assurances that a patch is in the works. It also doesn’t appear that any would-be hackers have yet attempted to take advantage of the flaw. What this does point out, however, (with glaring obviousness) is yet again how incredibly critical it is to have an adequate cyber security incident response plan in place.
Too often businesses in particular account for only one piece of the security puzzle. They invest tens to hundreds of thousands of dollars into monitoring systems, assuming that this alone will be enough to keep them ahead of potential attacks. Unfortunately, given the fact that these monitoring systems must be manned by humans, coupled with the volume and complexity of incoming threats, the chance of a serious attack being missed is alarmingly high. This is precisely what occurred in the Target breach of a few years ago.
The solution to this dilemma is fortifying the cyber-security incident response strategy with an automation tool. This removes the human element from the process. Technology can then handle the daunting task of assessing, verifying and prioritizing every legitimate threat that comes in. The automated tool will then execute the appropriate next steps, right through the final resolution, completing the process and closing the loop.
Thankfully this particular flaw was identified and addressed by one of the “good guys,” but make no mistake – had it been discovered by an attacker first, the outcome would have been potentially devastating. Like it or not, we are all at risk of a potential cyber-attack, especially businesses. Taking a proactive approach by developing, implementing and solidifying a strong cyber security incident response plan is absolutely critical in order to keep systems – and all the important sensitive data contained within – safe from a potential breach.