Red Hat Product Security had a busy year, like many of you most likely did, in 2019. As each year closes we take time to reflect upon all of “the security” we and our subscribers got to interact with throughout the calendar year. We put our findings into the Red Hat Product Security Risk Report and we’re proud to give you readers a quick summary of what we saw and what we did.
The Risk Report catalogues the vulnerabilities that were discovered and patched throughout the Red Hat product portfolio. We provide context to the CVEs that we felt could have the most impact from a real-world risk perspective, as well provide a filter to the fear, uncertainty and doubt that is sometimes sown around high profile vulnerabilities, which in turn introduces additional challenges to your operations.
Created in 2001, the Red Hat Product Security team has more than 19 years of direct experience in managing vulnerabilities and security within open source communities, and we provide our readers with calm advice through our advisories and through artifacts like the Risk Report. Without further delay, let’s get a brief summary of what happened in 2019:
2019 by the numbers
Overall, Red Hat Product Security reviewed 2,714 security flaw reports, continuing a slight downward trend of reports. 2017 was a banner year, marking the most reported issues to the team peaking at 3,034. This number includes all possible problems we learn about. As you’ll see in a moment, not all of those problems get to become CVEs for our offerings.
Sometime we’ll see reports for other vendors, we’ll get reports that don’t have a security impact, and other times (and most frequently) we’ll see a report for an open source project that might be included in a branded Red Hat product, but ultimately is determined to not affect us (due to our development and build practices, or our backporting methodologies). The hard-working women and men of our incoming team are the first responders here, doing the tough work of sorting the vulnerabilities that impact Red Hat products from those that do not. My fedora is off to them.
Working with our partners through Red Hat’s Product Engineering organization, 1,313 CVEs were addressed across our product and services portfolio. This is a slight increase from previous years, but smaller than our busiest year of bug fixing, 2017, where 1,342 were addressed. So, on average, just more than 100 things were addressed every month from our perspective.
Where the rubber meets the road
Where the rubber meets the road, so to speak, are the Red Hat Security Advisories (RHSA) that are issued and ultimately applied to a system, be it physical, virtual, or container. We released 968 RHSAs, which is a three-fold increase from 2011. This speaks to the diversity and complexity of the portfolio of 2019. System administrators have their work cut out for them, no matter what types of systems they manage, which is part of the reason one might note the difference in number of CVEs fixed versus the number of issued security advisories. As time, content, and opportunity allows, we’ll bundle multiple CVE updates into a single RHSA (but then issue separate RHSAs based off of product and version) to try and help ease that administrative burden of getting downtime windows for maintenance. Obviously, as an awesome enterprise vendor, we do have solutions that can help with that (cough, cough, Insights, cough cough, Ansible, cough Satellite… just sayin’).
The Risk Report covers these topics and many other more in-depth topics than this short missive does, but to speak to the highlights, here’s the year at a glance:
-
2,714 security issues were reported to Red Hat Product Security (slightly down from 2018)
-
1,313 CVEs were addressed throughout 2019, a 3.2% increase from 2018
-
968 Red Hat Security Advisories were issued, a record increase over previous years
-
40 Critical advisories addressing 27 Critical vulnerabilities
-
41% of Critical issues were addressed within 1 business day
-
85% of Critical issues were addressed within 1 week
Hopefully this stoked the fires of curiosity in you to read more about all of the amazing work Red Hat does to protect our subscribers. To learn more about the trends we saw and the security flaws that made an impact in 2019 please read the full report. Stay secure out there!
저자 소개
Christopher Robinson, better known as CRob to his colleagues, is a former Product Security Program Architect at Red Hat.
유사한 검색 결과
채널별 검색
오토메이션
기술, 팀, 인프라를 위한 IT 자동화 최신 동향
인공지능
고객이 어디서나 AI 워크로드를 실행할 수 있도록 지원하는 플랫폼 업데이트
오픈 하이브리드 클라우드
하이브리드 클라우드로 더욱 유연한 미래를 구축하는 방법을 알아보세요
보안
환경과 기술 전반에 걸쳐 리스크를 감소하는 방법에 대한 최신 정보
엣지 컴퓨팅
엣지에서의 운영을 단순화하는 플랫폼 업데이트
인프라
세계적으로 인정받은 기업용 Linux 플랫폼에 대한 최신 정보
애플리케이션
복잡한 애플리케이션에 대한 솔루션 더 보기
오리지널 쇼
엔터프라이즈 기술 분야의 제작자와 리더가 전하는 흥미로운 스토리
제품
- Red Hat Enterprise Linux
- Red Hat OpenShift Enterprise
- Red Hat Ansible Automation Platform
- 클라우드 서비스
- 모든 제품 보기
툴
체험, 구매 & 영업
커뮤니케이션
Red Hat 소개
Red Hat은 Linux, 클라우드, 컨테이너, 쿠버네티스 등을 포함한 글로벌 엔터프라이즈 오픈소스 솔루션 공급업체입니다. Red Hat은 코어 데이터센터에서 네트워크 엣지에 이르기까지 다양한 플랫폼과 환경에서 기업의 업무 편의성을 높여 주는 강화된 기능의 솔루션을 제공합니다.