Skip to main content
SpringerLink
Log in

Robin Müller, Julius Ruppert, Katharina Will, Lukas Wüsteney, Tobias Heer

Analyzing the Software Patch Discipline Across Different Industries and Countries

  • Aufsätze
  • Published:
Datenschutz und Datensicherheit - DuD Aims and scope Submit manuscript

Zusammenfassung

In view of recent cyberattacks and new regulatory requirements, companies in different industries and countries are forced to implement additional IT security measures. Nevertheless, a large number of services with vulnerable or outdated software can be found on the Internet. In this work, we investigate whether industry-specific differences exist in the maintenance and use of outdated Internet-facing software. For this purpose, we combine results from Internet-wide port scans with product and version information as well as information of companies listed at stock markets in different countries. We show that different industries have more or less up-to-date software for different services like remote access tools, databases, webservers and file servers. With this approach, we discovered surprising amounts of outdated and even unsupported software in use across many industries and countries.

This is a preview of subscription content, log in via an institution to check access.

Access this article

Log in via an institution

Price excludes VAT (USA)
Tax calculation will be finalised during checkout.

Instant access to the full article PDF.

Institutional subscriptions

References

  1. California Legislative Information: Bill Information. In: Assembly Bill No. 1906. 2018, url: https://leginfo.legislature.ca.gov/faces/ billTextClient.xhtml?bill%5C_id=201720180AB1906, Stand: 11.11.2021.

  2. Dahlmanns, M.; Lohmöller, J.; Fink, I.B.; Pennekamp, J.; Wehrle, K.; Henze, M.: Easing the Conscience with OPC UA: An Internet-Wide Study on Insecure Deployments. In: IMC ’20: Proceedings of the ACM Internet Measurement Conference. S. 101–110, 2020.

  3. Durumeric, Z.: Fast Internet-Wide Scanning: A New Security Perspective, Diss., University of Michigan, 2017.

  4. European Union Agency for Cybersecurity: enisa. In: NIS Directive. 2021, url: https://www.enisa.europa.eu/topics/nis-directive, Stand: 11.11.2021.

  5. ipinfo.io: IP Ranges API, 2021, url: https://ipinfo.io/developers/ ranges, Stand: 11.11.2021.

  6. Morishita, S.; Hoizumi, T.; Ueno, W.; Tanabe, R.; Gañán, C.; van Eeten, M.J.; Yoshioka, K.; Matsumoto, T.: Detect Me If You... Oh Wait. An Internet-Wide View of Self-Revealing Honeypots. In: 2019 IFIP/IEEE Symposium on Integrated Network and Service Management (IM). 2019.

  7. Müller, R.; Ruppert, J.; Will, K.; Wüsteney, L.; Heer, T.: HSES-Patchwatch Project Documentation, 2022, url: https://hs-esslingen-it-security.github.io/hses-patchwatch/. Stand: 19.01.2022.

  8. National Institute of Standards and Technology (NIST) – U.S. Department of Commerce: Common Platform Enumeration: Naming Specification Version 2.3, 2011, url: https://www.govinfo.gov/content/pkg/ GOVPUB-C13-c213837a04c3bcc778ebfd420c6a3f2a/pdf/GOVPUB-C13c213837a04c3bcc778ebfd420c6a3f2a.pdf, Stand: 11.11.2021.

  9. Na, S.; Kim, T.; Kim, H.: Service Identification of Internet-Connected Devices Based on Common Platform Enumeration. In: Journal of Information Processing Systems. Bd. 14, S. 740–750, 2018.

    Google Scholar 

  10. North American Electric Reliability Corporation: NERC. In: CIP Standards. 2021, url: https://www.nerc.com/pa/Stand/Pages/CIPStandards. aspx, Stand: 11.11.2021.

  11. Office of the National Security Council: Thailand. In: National Cybersecurity Strategy 2017-2021. 2017, url: http://www.nsc.go.th/wp-content/ uploads/2018/08/strategyit60-64-1.pdf, Stand: 11.11.2021.

  12. pci Security Standards Council: pci. In: Document Library. 2021, url: https://www.pcisecuritystandards.org/document_library, Stand: 11.11.2021.

  13. Wan, G.; Izhikevich, L.; Adrian, D.; Yoshioka, K.; Holz, R.; Rossow, C.; Durumeric, Z.: On the Origin of Scanning: The Impact of Location on Internet-Wide Scans. In: IMC ’20: Proceedings of the ACM Internet Measurement Conference. S. 662–679, 2020.

Download references

Author information

Authors and Affiliations

  1. Hochschule Esslingen, Esslingen, Deutschland

    Robin Müller, Julius Ruppert B.Eng., Katharina Will, Lukas Wüsteney M.Sc. &  Tobias Heer

Authors
  1. Robin Müller
    View author publications

    You can also search for this author in PubMed Google Scholar

  2. Julius Ruppert B.Eng.
    View author publications

    You can also search for this author in PubMed Google Scholar

  3. Katharina Will
    View author publications

    You can also search for this author in PubMed Google Scholar

  4. Lukas Wüsteney M.Sc.
    View author publications

    You can also search for this author in PubMed Google Scholar

  5. Tobias Heer
    View author publications

    You can also search for this author in PubMed Google Scholar

Corresponding author

Correspondence to Robin Müller.

Rights and permissions

Reprints and permissions

About this article

Check for updates. Verify currency and authenticity via CrossMark

Cite this article

Müller, R., Ruppert, J., Will, K. et al. Analyzing the Software Patch Discipline Across Different Industries and Countries. Datenschutz Datensich 46, 269–275 (2022). https://doi.org/10.1007/s11623-022-1602-y

Download citation

  • Published:

  • Issue Date:

  • DOI: https://doi.org/10.1007/s11623-022-1602-y

Search

Navigation