Server Software Risk Vector

Server Software is a Diligence risk vector. It tracks security problems introduced by software that are no longer supported. Supported software gets attention from the development team and vendor, so they can address bugs and vulnerabilities that are discovered.

This data can be used to create a rich picture about the software used by an organization, making it simple to maintain a robust, up-to-date array of server software applications in an organization’s IT infrastructure.

Learn more:

• Data Collection Methods
• Supported Operating Systems
• Supported Server Software
• What is the difference between supported and unsupported software?

Risks

• Leaves bugs and vulnerabilities unpatched.
• Exposes organizations to software bugs that can be exploited by attackers and may disrupt business continuity.

Grading

See how the Server Software risk vector is graded.

Insufficient Data

A default risk vector grade is assigned if there is insufficient or no data

Default:

The use of server software is not required to improve an organization’s cyber security posture. Therefore, there’s no penalty or negative impact to the rating in the absence of Server Software findings.

Lifetime

Lifetime is the number of days a finding impacts the risk vector grade, assuming nothing changes in the future and the finding is not updated with new information. This is defined by the number of days a finding will impact the risk vector grade. Learn why findings have a decay and lifetime period.

Duration: 60 Days

Weight

The Server Software risk vector contributes to the weight of the Diligence risk category, which aggregates the weights of all risk vectors in the category to 70.5% towards Bitsight Security Ratings.

Weight: 2%

Remediation

Resources

• Findings
• Finding Messages

Recommendations

• Identify out-of-date server software installations and update them.
• Ensure the organization has critical server software set to auto-update, if applicable, and if some of the organization’s production applications depend on certain unsupported versions, their software development teams will need to integrate the newer versions into their code base.
• Consult your operating system vendors’ software repositories and release notes for more information on supported server software for your organization.

Rescan Base Duration

The Bitsight platform regularly checks for new observations. Findings are rescanned as these observations change, e.g., newly observed Diligence findings or an existing finding was remediated.

Automated Scan: 8 Days

User-Requested Rescan: Instant reply. See timeline for details.

Data

Software support details are regularly updated on a monthly basis.

The following data is updated monthly:

• Operating Systems
• Server Software

Finding Behavior

The behavior of findings based on remediation and rescan statuses:

• New Observation
• Remediated
• Replacement findings are not applicable.

New Observation

New observations immediately impact the grade and are assigned its lifetime.

Remediated

• A new finding with a new rolled up ID is created. It impacts the grade for its 60-day lifetime.
• The previous finding continues to impact the grade and needs to complete its lifetime. Its rescan status is Assumed Remediated.
• There is a 28-day grace period after an outdated version to allow for validating and updating software packages.