{"id":7623,"date":"2020-07-19T04:24:13","date_gmt":"2020-07-19T11:24:13","guid":{"rendered":"https:\/\/webdev.securin.xyz\/?p=7623"},"modified":"2023-07-10T15:05:58","modified_gmt":"2023-07-10T22:05:58","slug":"how-safe-are-enterprise-data-storage-systems","status":"publish","type":"post","link":"https:\/\/10.42.32.162\/articles\/how-safe-are-enterprise-data-storage-systems\/","title":{"rendered":"How Safe are Enterprise Data Storage Systems?"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"7623\" class=\"elementor elementor-7623\" data-elementor-post-type=\"post\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-64cce371 elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"64cce371\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-7c6b5001\" data-id=\"7c6b5001\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-28151de5 elementor-widget elementor-widget-text-editor\" data-id=\"28151de5\" data-element_type=\"widget\" data-settings=\"{&quot;ekit_we_effect_on&quot;:&quot;none&quot;}\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t\t\t\t\t<blockquote><p><strong><span style=\"font-size: 22px;\">According to a recent <a href=\"https:\/\/www.marketsandmarkets.com\/Market-Reports\/network-attached-storage-market-35395533.html\">report<\/a> Network Attached Storage (NAS) market is touted to grow from $23.2 in 2020 billion to $48 billion.\u00a0<\/span><\/strong><\/p><\/blockquote><p>That\u2019s hardly a surprising forecast. With the pandemic restricting people from leaving their homes, most people are using enterprise data storage systems, VPNs, remote conferencing tools, BI, etc. to work remotely. And without a vaccine in place we are looking at an extended period of remote working.<\/p><p>While Enterprise data storage systems are great to work with\u00a0they are also sitting ducks for threat attacks.<\/p><p>In our recent report series \u2018<a href=\"https:\/\/cybersecurityworks.com\/resources\/cyber-risk-series\/cyber-risk-in-enterprise-data-storage.html\" target=\"_blank\" rel=\"noopener\">Cyber Risk in Enterprise Database<\/a>\u2019 we examined popular enterprise data storage applications for vulnerabilities and found that there were many vulnerabilities that have potentially become weaponized and the prognosis is not good.<\/p><p>If this technology is going to be used widely in the next few years, then it is important that critical vulnerabilities that exist in these products be fixed.<\/p><h3><strong>Key Findings<\/strong><\/h3><p>The report puts popular Enterprise Data Storage Systems under the lens and delves deep into their vulnerabilities.<\/p><blockquote><ul><li><span style=\"font-size: 20px;\"><strong><span style=\"font-family: times new roman,times,serif;\">108\u00a0CVEs are weaponized<\/span><\/strong><\/span><\/li><li><span style=\"font-size: 20px;\"><strong><span style=\"font-family: times new roman,times,serif;\">56\u00a0CVEs have RCE and Privilege Execution<\/span><\/strong><\/span><\/li><li><span style=\"font-size: 20px;\"><strong><span style=\"font-family: times new roman,times,serif;\">3\u00a0CVEs are associated with Ransomware\u00a0Ryuk<\/span><\/strong><\/span><\/li><li><span style=\"font-size: 20px;\"><strong><span style=\"font-family: times new roman,times,serif;\">Scanners such as Nessus, Nexpose, Qualys have missed\u00a041,\u00a043, and\u00a030\u00a0vulnerabilities, respectively.<\/span><\/strong><\/span><\/li><\/ul><\/blockquote><h3>\u00a0<\/h3><h3><strong>Vulnerabilities in Enterprise Data Storage Systems<\/strong><\/h3><p>We analyzed over <span style=\"color: #b22222;\"><strong>741<\/strong><\/span><span style=\"color: #ff0000;\"><strong>\u00a0<\/strong><\/span>vulnerabilities in total and found <span style=\"color: #b22222;\"><strong>108\u00a0<\/strong><\/span>CVEs have been weaponized. Out of these, <span style=\"color: #b22222;\"><strong>56\u00a0<\/strong><\/span>CVEs are associated with RCE (Remote Code Execution),<b> <\/b>and <span style=\"color: #b22222;\"><strong>3 <\/strong><\/span>are connected to Ransomware.<\/p><p><img decoding=\"async\" style=\"width: 550px; height: 377px;\" src=\"https:\/\/cybersecurityworks.com\/howdymanage\/uploads\/image\/ent1.png\" alt=\"\" \/><\/p><h3><strong>Weaponization of Vulnerabilities<\/strong><\/h3><p>Among the popular vendors that went under our microscope, our findings reveal the following \u2013<\/p><ul><li><strong>Netapp <\/strong>\u00a0and <strong>Synology <\/strong>have the maximum number of vulnerabilities that are yet to weaponized<\/li><li><strong>Zyxel <\/strong>(<strong><span style=\"color: #b22222;\">28<\/span><\/strong>) has the maximum number of weaponized vulnerabilities followed by <strong>Synology <\/strong>(<strong><span style=\"color: #b22222;\">21<\/span><\/strong>).<\/li><\/ul><p><img decoding=\"async\" style=\"width: 650px; height: 910px;\" src=\"https:\/\/cybersecurityworks.com\/howdymanage\/uploads\/image\/ent2.png\" alt=\"\" \/><\/p><h3><strong>Critical vulnerabilities<\/strong><\/h3><p>There are <strong><span style=\"color: #b22222;\">121 <\/span><\/strong>critical vulnerabilities in total and among them, Zyxel (<strong><span style=\"color: #b22222;\">18<\/span><\/strong>) has the highest number of critical vulnerabilities, followed by NEC (<strong><span style=\"color: #b22222;\">17<\/span><\/strong>) and Qnap (<span style=\"color: #b22222;\"><strong>14<\/strong><\/span>).<\/p><p><img decoding=\"async\" style=\"width: 550px; height: 717px;\" src=\"https:\/\/cybersecurityworks.com\/howdymanage\/uploads\/image\/ent3.png\" alt=\"\" \/><\/p><p>We analyzed the weaponization trends for the past decade and found that weaponization rates have been increasing since the year 2015 and it spiked in 2017 and 2018.<\/p><p><img decoding=\"async\" style=\"width: 550px; height: 582px;\" src=\"https:\/\/cybersecurityworks.com\/howdymanage\/uploads\/image\/ent4.png\" alt=\"\" \/><\/p><p>If there is going to be a spike in the usage of Enterprise Data Storage systems, then these vulnerabilities need to be fixed immediately.<\/p><p style=\"text-align: center;\"><strong><span style=\"font-size: 18px;\">Count of vulnerabilities missed by popular scanners<\/span><\/strong><\/p><table style=\"width: 500px;\" border=\"1\" cellspacing=\"1\" cellpadding=\"1\" align=\"center\"><tbody><tr><td style=\"text-align: center;\">\u00a0<\/td><td style=\"text-align: center;\"><strong>Nessus<\/strong><\/td><td style=\"text-align: center;\"><strong>Nexpose<\/strong><\/td><td style=\"text-align: center;\"><strong>Qualys<\/strong><\/td><\/tr><tr><td style=\"text-align: center;\"><strong>Asustor<\/strong><\/td><td style=\"text-align: center;\">3<\/td><td style=\"text-align: center;\">3<\/td><td style=\"text-align: center;\">1<\/td><\/tr><tr><td style=\"text-align: center;\"><strong>Commvault<\/strong><\/td><td style=\"text-align: center;\">0<\/td><td style=\"text-align: center;\">2<\/td><td style=\"text-align: center;\">2<\/td><\/tr><tr><td style=\"text-align: center;\"><strong>Drobo<\/strong><\/td><td style=\"text-align: center;\">1<\/td><td style=\"text-align: center;\">1<\/td><td style=\"text-align: center;\">0<\/td><\/tr><tr><td style=\"text-align: center;\"><strong>EMC<\/strong><\/td><td style=\"text-align: center;\">1<\/td><td style=\"text-align: center;\">1<\/td><td style=\"text-align: center;\">1<\/td><\/tr><tr><td style=\"text-align: center;\"><strong>HP<\/strong><\/td><td style=\"text-align: center;\">1<\/td><td style=\"text-align: center;\">1<\/td><td style=\"text-align: center;\">1<\/td><\/tr><tr><td style=\"text-align: center;\"><strong>QNAP<\/strong><\/td><td style=\"text-align: center;\">9<\/td><td style=\"text-align: center;\">9<\/td><td style=\"text-align: center;\">3<\/td><\/tr><tr><td style=\"text-align: center;\"><strong>Seagate<\/strong><\/td><td style=\"text-align: center;\">6<\/td><td style=\"text-align: center;\">6<\/td><td style=\"text-align: center;\">4<\/td><\/tr><tr><td style=\"text-align: center;\"><strong>Synology<\/strong><\/td><td style=\"text-align: center;\">8<\/td><td style=\"text-align: center;\">8<\/td><td style=\"text-align: center;\">7<\/td><\/tr><tr><td style=\"text-align: center;\"><strong>XEN<\/strong><\/td><td style=\"text-align: center;\">1<\/td><td style=\"text-align: center;\">1<\/td><td style=\"text-align: center;\">1<\/td><\/tr><tr><td style=\"text-align: center;\"><strong>Yamaha<\/strong><\/td><td style=\"text-align: center;\">1<\/td><td style=\"text-align: center;\">1<\/td><td style=\"text-align: center;\">1<\/td><\/tr><tr><td style=\"text-align: center;\"><strong>Zyxel<\/strong><\/td><td style=\"text-align: center;\">10<\/td><td style=\"text-align: center;\">10<\/td><td style=\"text-align: center;\">9<\/td><\/tr><tr><td style=\"text-align: center;\"><strong>Total<\/strong><\/td><td style=\"text-align: center;\"><strong>41<\/strong><\/td><td style=\"text-align: center;\"><strong>43<\/strong><\/td><td style=\"text-align: center;\"><strong>30<\/strong><\/td><\/tr><\/tbody><\/table><p>\u00a0<\/p><p><strong><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-6110\">CVE-2019-6110<\/a><\/strong> in Vmware, a server vulnerability that was used in Ryuk Ransomware attacks in the past, <strong><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2018-20685\">CVE-2018-20685<\/a><\/strong>, and <strong><a href=\"https:\/\/nvd.nist.gov\/vuln\/detail\/CVE-2019-6109\">CVE-2019-6109<\/a><\/strong> in Western Digital also associated with the same ransomware have not been detected by these scanners. These vulnerabilities need to be fixed immediately before they are exploited in the wild.<\/p><p style=\"text-align: center;\"><span style=\"font-size: 18px;\"><strong>Download the whitepaper\u00a0<a href=\"https:\/\/cybersecurityworks.com\/resources\/cyber-risk-series\/cyber-risk-in-enterprise-data-storage.html\" target=\"_blank\" rel=\"noopener\">Cyber Risk in\u00a0Enterprise Data Storage<\/a><\/strong><\/span><\/p><p style=\"text-align: center;\"><span style=\"font-size: 18px;\"><strong><a href=\"https:\/\/cybersecurityworks.com\/resources\/cyber-risk-series\/cyber-risk-in-enterprise-data-storage.html\" target=\"_blank\" rel=\"noopener\"><img decoding=\"async\" style=\"width: 500px; height: 571px;\" src=\"https:\/\/cybersecurityworks.com\/howdymanage\/uploads\/image\/crs-entreprise-data-banner.png\" alt=\"\" \/><\/a><\/strong><\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>While Enterprise data storage systems are great to work with, they are also sitting ducks for threat attacks. Find out how?<\/p>\n","protected":false},"author":1,"featured_media":7624,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"content-type":""},"categories":[138,80,109],"tags":[325,324,178,326,177,141,327,139,319,328],"acf":[],"aioseo_notices":[],"_links":{"self":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7623"}],"collection":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/comments?post=7623"}],"version-history":[{"count":9,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7623\/revisions"}],"predecessor-version":[{"id":18781,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/posts\/7623\/revisions\/18781"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media\/7624"}],"wp:attachment":[{"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/media?parent=7623"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/categories?post=7623"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/10.42.32.162\/wp-json\/wp\/v2\/tags?post=7623"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}