The Desktop Software risk vector looks at a desktop device’s software version and compares it with the latest and currently available software versions to determine if the device software is supported or out of date. Download the endpoint OS-browser versions (ver. 25-SEP-2024) list.
Desktop devices are laptops, servers, and other non-tablet, non-phone computers in a company's network that access the Internet. The outgoing communications from desktop devices include metadata about the device's operating system and browser version (endpoint data).
Risks
Newer versions of operating systems and web browsers typically fix stability issues, bugs, and vulnerabilities that existed in older versions. Bad actors frequently exploit known bugs in older software versions to steal information or run malicious software. The use of unsupported operating systems and browsers is correlated with the presence of a high number of malware infections and an increased likelihood of breach.
- If there are unsupported desktop devices in an organization's network, there is a greater risk of:
- System failure (vendor devices are not being maintained).
- Disruption of business continuity.
- Attackers may be able to use unpatched vulnerabilities to gain system access.
- Connecting a personal device to corporate network infrastructure adds a potential surface of attack for a threat actor to gain access to company data and sensitive information.
Grading
See how the Desktop Software risk vector is graded in more detail.
| Concept | Behavior |
|---|---|
|
Duration: 65 Days |
|
| Insufficient Data |
Default: This default grade does not have a negative impact on the rating. It is equivalent to a perfect grade. Either:
|
|
Percentage (out of 70.5% in Diligence): 3% |
Remediation
Resources
Recommendations
- Search and identify unsupported desktop software, and then update the software to the latest version.
- Set up auto-update methods for critical desktop software.
- Insufficient information prevents Bitsight from identifying unsupported software. The use of software device management systems is recommended, along with integrating human processes that ensures systems in the organization are patched and the software is up-to-date.
Finding Behavior
| Concept | Behavior |
|---|---|
|
The Bitsight platform regularly checks for new observations. Bitsight findings are updated as these observations change, e.g., newly observed Diligence findings or an existing finding was remediated. |
Automated Scan Duration: Not Applicable User-Requested Refresh Duration: Not Applicable This risk vector is not assessed using automated scans. Instead, our internal records are updated weekly based on data received from our partners. Learn more about how this risk vector is observed. |
|
There’s a grace period of 28 days for validating and updating software packages. |
- September 26, 2024: Updated attached sheet containing OS-browser versions.
- August 22, 2024: Updated attached sheet containing OS-browser versions.
- July 30, 2024: Updated attached sheet containing OS-browser versions.
Feedback
6 comments
Where is this information collected? Are these devices discovered to be associated with the vendor/company or is this noting that the vendor/company simply allows connections from unsupported versions?
Hello KyleP. Our data partners provide us with the user-agent string from endpoint clients that are loading the content, which includes information about the operating system, the device name (for mobile), browser information (IP address and cookie data). You can learn more here: How are the Desktop Software and Mobile Software Risk Vectors Observed?
Please, can we have a monthly update of " endpoint OS-browser versions list." ?
Hello José. The OS-browser versions list is new as of February 2024. We are still working out the cycle on when and how often to update this. In the meantime, I will check on if there's a newer version available at the moment.
Ingrid, if the issue gets remediated, what would the process be for updating the information on BitSight? Are you able to provide more information?
Sharoon Reyes I think you may be referring to finding refresh, which is when the Bitsight platform checks for new observations and then update the findings as these observations change, e.g., newly observed Diligence findings or an existing finding was remediated.
For the Desktop Software risk vector, we check our internal records on data received from our partners on a weekly basis.
Please sign in to leave a comment.