This article first appeared in Digital Edge, The Edge Malaysia Weekly on November 2, 2020 - November 8, 2020

Just as robbers can break into your house to steal your physical appliances, hackers can do the same with your virtual appliances that use cloud services.

In fact, virtual appliances may be more vulnerable. After conducting a test on over 2,000 virtual appliances from 540 vendors this year, Orca Security found that only 8% were free of known vulnerabilities. Even products by some established brands were found to be riddled with them. These results are published in The Orca Security 2020 State of Virtual Appliance Security report.

A virtual appliance refers to a software application that resides and operates in a preconfigured virtual environment or platform, according to Techopedia (see box story).

“The barrier to entry for selling a physical appliance [for business purposes] is higher. But the barrier to entry for selling a virtual appliance is low because it’s a software. That’s why there are many vendors offering it these days. But it seems like a lot of them do not ensure that it’s updated and maintained properly,” says Avi Shua, CEO and co-founder of Orca Security.

The company used its patent-pending SideScanning technology and found that 15% of software vendors failed its test, while less than 10% had no known vulnerabilities. Some well-known vendors such as Intel and Symantec had products at both ends of the spectrum.

In addition, only 14% of the tested virtual appliance images have been updated within the last three months, while 47% have not been updated in the past year. The pricier virtual appliances do not necessarily achieve higher scores either.

The SideScanning technology targets 16 vulnerabilities in virtual appliances that could present risks. In the worst-case scenario, exploit codes may target the known vulnerabilities and enable attacks. SideScanning also uncovers misconfigurations, weak authentication and insecure data, among other problems.

Fortunately, some vendors have taken action after receiving Orca Security’s report. Overall, 534 products named have been updated and 39 removed from distribution. Among the companies that took the results seriously were Cisco, Intel, Dell, IBM, TrendMicro and Qualys.

Shua advises businesses to work with reputable vendors when selecting virtual appliances going forward. Users should demand regular software updates and patches for any known vulnerabilities, he adds.

“Also, make sure that you use something that is the main product of the company. Otherwise, you might be stuck with something that is not maintained well.”

The vendors with higher scores in the report were more likely to respond to Orca Security’s emails, Shua observes. This shows that these companies probably have dedicated security teams to handle any problem.

“I’m a big believer of basic cybersecurity. People like to talk about complex solutions but they should make sure that their basics are handled well. If vendors are still shipping solutions with thousands of known vulnerabilities, then there is no need to talk about advanced cybersecurity. On the flip side, we’ve seen vendors that have processes that continuously maintain and update their appliances,” says Shua.

Save by subscribing to us for your print and/or digital copy.

P/S: The Edge is also available on Apple's AppStore and Androids' Google Play.