-2

Is there any evidence or research into the likelihood, as well as damage, via vulnerabilities in previous versions compared to following iterations of software?

For example, with every software version, there is the likelihood of new security vulnerabilities. More importantly, the existence and likelihood of those vulnerabilities will be unknown. Whereas by staying on the previous version, even if you're now vulnerable to a possibly existing risk, it may be a vulnerability that is documented. Of course, that may not always be the case but if it is an unknown vulnerability in version 1, then it will be an unknown vulnerability in version 1+. If that vulnerability is mitigated in version 1+, then we're back to the point of this question:

  1. Version 1: unknown and known vulnerabilities, versus
  2. Version 1+: unknown and possible introduction of different vulnerabilities

This is not a duplicate of other questions with similar titles because I'm looking for facts, whereas a lot of other posts include much conjecture.

Improve this question
10
  • 1
    So, other questions like: security.stackexchange.com/questions/163244/…
    – schroeder ♦
    Jan 29, 2020 at 22:11
  • 1
    Just because you don't like the answers does not mean the question is invalidated. If the question is the same, then it's a duplicate. There are other means to get different answers to the question rather than asking it again
    – schroeder ♦
    Jan 29, 2020 at 22:14
  • 1
    It just seems like you are confusing the questions with the answers (since your words focus on the answers to justify a new question). There is a lot of confusing wording in your question in general. Also, if referencing "other questions" it's nice to provide a link so we know what you don't want and how you think this question is different.
    – schroeder ♦
    Jan 29, 2020 at 22:22
  • 1
    I'm not sure that it is possible to research a future unknown state, so I don't think the evidence you are looking for could possibly exist. There's no linear relationship to explore. At best, you might be able to record vulnerabilities introduced in updates in one product line, but that's not going to inform anyone about the likelihood of new vulnerabilities in any other software. The impact of any future unknown vulnerability would also be impossible to assess. So, your question is asking to quantify future unknown unknowns based on historical data of unrelated systems. You can't.
    – schroeder ♦
    Jan 29, 2020 at 22:28
  • 1
    That's why, in the answer to the question I linked (it happens to be my answer) it talks about being aware of the unknown and being able to rapidly detect and respond because software is a highly complex and unpredictable system where risk analysis between functional versions is nearly impossible to assess. You can't quantify it. If you would like, I could include in that answer the papers that talk about that phenomenon.
    – schroeder ♦
    Jan 29, 2020 at 22:32

1 Answer 1

Reset to default
1

While not popular, I'm going to do a frame-challenge answer here.

You say:

Whereas by staying on the previous version, even if you're now vulnerable to a possibly existing risk, it may be a vulnerability that is documented.

You're framing that as a good thing, as in "It's documented, so we can apply the listed mitigations".

I'm taking it as a bad thing, as in "It's documented, so attackers know exactly where to poke". Even if you mitigated against the reported vuln, in my experience, in the process of fixing a reported vuln, a vendor will often discover and fix a number of related vulnerabilities, usually quietly.

Also, what about researchers who only bother to test the latest versions; just because a CVE says "Affects version 2.3.4" isn't necessarily proof that 2.3.3 - or even 1.1.0 - is immune.

I am aware that I have not answered your question. Maybe you're looking for research comparing hacks exploiting a known vuln for which a patch is available vs hacks exploiting 0-days.

A Google Scholar search for "zero day prevalence", and "zero day vs known" both return lots of results that seems to be in the direction that you're looking for. Maybe one of those will answer your question?

It sounds to me like you are looking for justification to avoid upgrading. Patch your servers!!

If you want to reduce risk, I think the best solution is to be on a long-term-support version that is still receiving security patches, but is not receiving new experimental features.

Improve this answer
1
  • “It sounds to me like you are looking for justification to avoid upgrading. Patch your damn servers!!” This is so unnecessary and sours what is an otherwise good answer. My standard practice is to upgrade, but even if it wasn’t, your remark is still a fruitless assumption.
    – 8protons
    Jan 30, 2020 at 15:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .