According to the vulnerability intelligence specialist, Secunia, network vulnerabilities have increased by a factor of four in three years.
Overall, no significant change was found in the total number of vulnerabilities being counted, however, private users' end-points experienced an increase of magnitude, by 71% in the last 12 months alone.
This key trend, says Secunia, is primarily the result of vulnerabilities found in third-party (non-Microsoft) programmes, which are also much harder to patch due to a lack of a unifying patch mechanism.
This lack of unity and automation, coupled with the sheer complexity of IT systems and lack of user awareness about patching, results in a lengthy process.
The report suggests that end users with an average software portfolio installed on their PCs will need to master around 14 different update mechanisms from individual vendors to update their programmes and keep their IT systems protected against vulnerabilities.
As a result, there is a huge delay from the point in time when vulnerabilities are discovered and details reach cybercriminals, before users and corporate security teams actually deploy the appropriate security updates.
Despite vulnerabilities being the weakest point in modern IT systems, Secunia notes that the main challenge is to educate users and IT administrators/departments to prioritise the deployment of security updates.
To reduce the risk of vulnerability threats in 2011, the report recommends that users should increase the awareness and prioritisation of regular third-party programme patching and adopt a unified, automated approach in order to simplify and streamline the updating process.
The report concludes by saying that it is important to note that a security patch provides better security than any number of anti-virus or other detection signatures as a patch eliminates the root cause.
Anti-virus and perimeter protection are established and needed defence technologies which enjoy a high priority, whereas patching is typically seen as a secondary security measure.
Against this backdrop, the report recommends that effective patching should be prioritised according to the evolving threat landscape