Response of software vendors to vulnerabilities

Although a lot of work and proposals are currently in place to help mitigate vulnerabilities, but unfortunately vulnerabilities double up each year. With the current high growth in software security breaches, this work aim to provide a thorough discussion on vulnerability and the response of software vendors to it, with emphasis on patch availability and reliability. In recent years, there has been a massive shift in vulnerability trends and exploit from the commonly known sewer exploitation to client applications exploits such as web browsers, backup sofiware, antivirus, media player and flash. This has constituted to the continuous rise in the vulnerability listings each year. Despite vendors' effort in making a workable solution "Batches" available for these vulnerabilities, the issue is: Are these patches readily available to end-users? And if yes, how reliable are the patches? This work presents the result from the examination of data from various databases in order to investigate vendors' response to vulnerabilities. To ascertain this, data on vulnerability reports were collated on 9 different vendors over a period of 5 years. Analysis was focused on comparing the total patched to the un-patched vulnerabilities disclosed yearly by each of these vendors. The study reveals the consistent growth in vulnerability despite the various tools developed to help mitigate them. While some vendors are more vulnerable than others, it was realized that not all of them have a structured security approach to vulnerability mitigation process. For the few ones in place, it takes so much time for them to make a patch available to users and such delay had contributed to the wide spread of vulnerabilities and its increasing number. Furthermore, when a patch is supposed to be a solution, it sometimes constitutes more ham than good. This work highlights some potential problems such as incompatibility, complexity, faulty and unavailability of patches. There is need for vendors to simplify patchesas much as they can and also make it available to all end-users not limiting it to just licensed users as vulnerability spread do not have limitations. Also end-users can contribute to reducing vulnerability growth by using the recommended security tools to safeguard themselves from exploits and manage patching processFaculty of Technolog