The Cyber Protection Enhancement Research Centre published its third experimental study of security vulnerabilities in the Lebanese “digital domain”.
The study set out from the current main trends of cyber attacks at the global level in order to identify 20 security vulnerabilities classified as critical under the global classification (CVSS) in widely used software in digital information systems, so as to focus on identifying the systems open to breach in the Lebanese digital domain.
The study revealed the existence of 976 serious vulnerabilities in the various information systems in Lebanese cyberspace during the second quarter of 2021, across various sectors - industrial, tourism, services, banking, technology and others.
The study reached two basic conclusions:
1 - Critical vulnerabilities: the continued existence of a large number of “old” vulnerabilities, especially in servers and network protection devices (used in institutions and companies), despite more than two months having passed since they were announced - indeed the appearance of new systems suffering from these old vulnerabilities, which raises serious concerns about the security awareness of companies in Lebanon. On the other hand, the second-quarter results show that Lebanon is strongly affected by new security vulnerabilities (for example those found in Microsoft Exchange), which confirms the need for a national body that tracks news of new security vulnerabilities in order to address them at the level of Lebanese digital space, in preparation for their treatment by the relevant bodies.
2 - Compliance violations according to the global scope (CIS): what draws attention is the large number of unpatched programmes and libraries, which confirms the first conclusion. On the other hand, the relatively large number of unencrypted logins places a large question mark, since the user's unencrypted login data is sent from the user's browser to the server through all the network elements around the world - which allows everyone with access to the network elements to view this data, and that is a very serious aspect.
