Southern states have the most open cyber exposures, report finds
cybrain/Getty Images
The 14 states in that region have more than 100,000 vulnerabilities, misconfigurations and data leaks that all must be addressed to prevent attacks, researchers found.
Southern states have the most open exposures that could be exploited by hackers and cyberattacks, according to a report published last week.
Researchers from cybersecurity services firm Securin determined a region’s security and attack surfaces by passively scanning and analyzing the 50 states’ government domains and associated websites, web applications, APIs, domain routing and certificates that are exposed to the internet.
The 14 states that make up the South have more than 109,000 open exposures, meaning misconfigurations, data leaks and product vulnerabilities that have not been patched.
The South also has 778 unpatched Known Exploited Vulnerabilities as defined by the Cybersecurity and Infrastructure Security Agency, according to a joint study by cybersecurity companies Cyber Security Works (CSW), Ivanti, Cyware and Securin. Those KEVs have been exploited in the past and have federal guidelines for remediation.
Researchers found that the 12 states in a Midwest region that the report defines as stretching from Indiana in the east to North and South Dakota in the west have 6,655 exposures that could be exploited by ransomware, which CSW CEO Aaron Sandeen said in an email “provide adversaries with opportunities to maliciously leverage unpatched vulnerabilities and exposed assets.”
Western states—an area researchers said constitutes 13 states including Alaska and Hawaii—have the highest number of assets and so have the largest attack surface. “Unmanaged assets within these attack surfaces can invariably expose sensitive data or provide a path for adversaries to infiltrate critical assets,” the report said.
In an email, Sandeen said state and local governments, as well as educational institutions, face “significant challenges” in managing their cybersecurity assets.
“These organizations have vast networks, a large number of assets to manage, and are often asked to do more with less, all while serving a massive user base,” Sandeen continued. He did not respond to questions on why certain regions have more vulnerabilities than others.
Researchers indicated there is much more to be done to identify and evaluate every threat. The report said that popular network scanners do not detect around 20 vulnerabilities typically associated with ransomware, while CISA’s KEV list has yet to add approximately 131 vulnerabilities associated with ransomware.
Some issues have persisted for many years, too. The report said that more than three quarters of vulnerabilities that are still being exploited by ransomware were discovered between 2010 and 2019. And of the 56 vulnerabilities that were tied to ransomware attacks last year, 20 were discovered between 2015 and 2019, the report said.
Srinivas Mukkamala, chief product officer at Ivanti, said in a statement that ransomware must be “top of mind for every organization” in the private or public sector. Researchers identified 344 vulnerabilities associated with ransomware in 2022, which they said represents a 19% year-over-year increase.
Given those vulnerabilities, Sandeen and Mukkamala called on states to implement an attack surface management platform that “continuously monitors for known and unknown assets and prioritizes exposure remediation.” But Sandeen acknowledged that governments’ efforts to reduce their attack surface is an “ongoing journey” that also includes strong access controls, regular software updates, security assessments and employee training.
Governments also need an enterprise-level view of all their systems, Sandeen said, adding that a culture shift will be necessary for the kind of continuous monitoring and improvement that is required for effective vulnerability management.
NEXT STORY: Workforce gaps could impact zero trust rollout