A study carried out by researchers from the Centre for Research on Strengthening Cyber Protection revealed Lebanon CERT the existence of 653 security vulnerabilities in a sample of 39,620 information systems in various sectors in Lebanon (banks, technology and insurance, education, medicine, government institutions…).
This study is the second to have worked on assessing information systems in Lebanon in various sectors, by testing the extent to which these systems are exposed to breach through some of the announced vulnerabilities present in software used by these systems.
In this field these systems were tested and it was determined whether they were exposed and liable to breach or not. In the test results it became clear that there were 653 exposed information systems containing information security vulnerabilities, and any novice intruder could obtain the programme that carries out the breach and take complete control of these systems.
It is worth noting here that a number of the security vulnerabilities examined during this study were later exploited by hackers to breach a number of international companies such as Essilor Luxottica, Duesseldorf University Hospital…
This study comes after a first study published at an international scientific conference, the International Symposium on Digital Forensics and Security, 2020, which Lebanese media covered, and which showed the existence of about 1,645 security vulnerabilities in 24,382 information systems covered by the survey.
It should be noted that the second study observed the extent of the response of those supervising the information systems: after the first study, contact was made with those in charge of the information systems containing security vulnerabilities to explain the vulnerabilities present and the proposed solutions. The same systems were then scanned for the same previously discovered vulnerabilities within the second study (that is, after about a year had passed since the vulnerabilities were announced in the first study), and it became clear that 57% of the systems had not been updated to close the vulnerabilities: there are still 400 exposed systems out of 701 systems that were discovered and whose owners were informed - in addition to the discovery of 253 newly exposed systems, owing to their use of one of the 13 programmes that had not been updated on these systems.
Here the second assessment study confirmed the continued existence of a shortfall in applying two of the most important practical practices in the field of cyber security, namely:
- Managing the updating and development of information systems (patch management)
- Handling cyber incidents (incident handling)
This is in addition to the lack of awareness of information security risks even among some of those supervising the information systems.
Hence the importance of the initiative taken by the researchers in establishing the Centre for Research on Strengthening Cyber Protection
Lebanon Cybersecurity Empowering Research Team (Lebanon CERT), (https://lebanoncert.org),
which is a non-profit organization (Non-Profit Organization) that works to raise the level of cyber security and to spread awareness of the risks arising in cyberspace among institutions and individuals in Lebanese society.
This centre aims to protect the digital systems used by governmental, industrial, banking, service, educational and other institutions, through a constant and continuous assessment of the exposed vulnerabilities that allow novice hackers to take control of these systems.
In addition, the centre works to inform any institution in which an exposed cyber vulnerability is confirmed by sending an email containing the details that help avert any possible cyber attack on its system. It also aims to spread awareness of cyber security risks and their repercussions on all sectors, and to help these sectors protect their digital systems continuously.
The centre's researchers look forward to founding a joint effort whose basis is the involvement of different parties - from cyber security companies to internet service providers, information systems administrators and technical officials from the public sector - in assessing and treating cyber vulnerabilities and the systems liable to breach.
To view the second study, visit the following link:
To view the first study, visit the following link: https://lebanoncert.org/en/blog/vulnerabilities_study_q1_2020
