Risk
2/26/2010
02:31 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

State Of Application Security: Nearly 60 Percent Of Apps Fail First Security Test

Veracode app-testing data demonstrates that application security still has a ways to go

SAN FRANCISCO -- RSA Conference 2010 -- Even with all of the emphasis on writing software with security in mind, most software applications remain riddled with security holes, according to a new report released today about the actual security quality of all types of software.

Around 58 percent of the applications tested by application security testing service provider Veracode in the past year-and-a-half failed to achieve a successful rating in their first round of testing. "The degree of failure to meet acceptable standards on first submission is astounding -- and this is coming from folks who care enough to submit their software to our [application security testing] services," says Roger Oberg, senior vice president of marketing for Veracode. "The implication here is that more than half of all applications are susceptible to the kinds of vulnerabilities we saw at Heartland, Google, DoD, and others -- these were all application-layer attacks."

The data for Veracode's State of Software Security Report comes from a combination of static, dynamic, and manual testing of all types of software across multiple programming languages -- everything from non-Web and Web applications to components and shared libraries. Veracode tests commercial, internally developed, open-source, and outsourced applications, all of which were represented in its findings.

And nearly 90 percent of internally developed applications contained vulnerabilities in the SANS Top 25 and OWASP Top 10 lists of most common programming errors and flaws in the first round of tests, Oberg says.

So is software getting more or less secure? Hard to say, Veracode says, since this is the first such report, and there's nothing to compare it to. "We don't know if it's getting better or worse, but it's pretty bad," Oberg says. "Despite all of the awareness about breaches ... this awareness doesn't translate into sufficient action. We hope this report is a call to action."

Around 60 percent of the software tested by Veracode was internally developed applications; 30 percent, commercial applications; 8 percent, open source; and 2 percent, outsourced. The software was 60 percent Web applications, and 40 percent non-Web, according to Veracode, and came from companies across 15 different industries.

Despite the relatively gloomy picture of developers still missing the mark initially on security, there were some bright spots in the report: Open-source software isn't as risky as you'd think, and financial services organizations and government agencies tend to have more secure applications from the get-go; more than half of their apps passed as acceptable in the first submission to testing, according to Veracode's report.

"The conventional wisdom is that open source is risky. But open source was no worse than commercial software upon first submission. That's encouraging," Oberg says. And it was the quickest to remediate any flaws: "It took about 30 days to remediate open-source software, and much longer for commercial and internal projects," he says.

Meanwhile, financial services firms and government agencies were second-best in terms of remediation: They took anywhere from one to two tries to fix their vulnerabilities. "This is good news. But there's a lot of room for improvement," Oberg says.

The data showed that third-party software is often a part of internally developed apps -- 30 percent of them were based on third-party apps.

The vulnerability with the highest total count was cross-site scripting (XSS), and was the third most prevalent flaw. "There's been intense focus on cross-site scripting, and there are lots of different libraries and utilities available to eliminate it, but it's still extremely prevalent," says Chris Eng, director of security research for Veracode. Eng says it's likely due to a lack of education on how to quell XSS, plus it's not uncommon to find 100 XSS bugs in one application. "Cross-site scripting adds up real quickly," he says.

Around 20 percent of the applications carried a SQL injection flaw, and most of those were Web applications. And 44 percent of the apps had one or more cryptographic flaw issue, Eng says. "Crypto issues are not generally well-understood by developers," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-2413
Published: 2014-10-20
Cross-site scripting (XSS) vulnerability in the ja_purity template for Joomla! 1.5.26 and earlier allows remote attackers to inject arbitrary web script or HTML via the Mod* cookie parameter to html/modules.php.

CVE-2012-5244
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Banana Dance B.2.6 and earlier allow remote attackers to execute arbitrary SQL commands via the (1) return, (2) display, (3) table, or (4) search parameter to functions/suggest.php; (5) the id parameter to functions/widgets.php, (6) the category parameter to...

CVE-2012-5694
Published: 2014-10-20
Multiple SQL injection vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 allow remote attackers to execute arbitrary SQL commands via the (1) agentPhNo, (2) controlPhNo, (3) agentURLPath, (4) agentControlKey, or (5) platformDD1 parameter to frameworkgui/attach2Agents.p...

CVE-2012-5695
Published: 2014-10-20
Multiple cross-site request forgery (CSRF) vulnerabilities in Bulb Security Smartphone Pentest Framework (SPF) 0.1.2 through 0.1.4 allow remote attackers to hijack the authentication of administrators for requests that conduct (1) shell metacharacter or (2) SQL injection attacks or (3) send an SMS m...

CVE-2012-5696
Published: 2014-10-20
Bulb Security Smartphone Pentest Framework (SPF) before 0.1.3 does not properly restrict access to frameworkgui/config, which allows remote attackers to obtain the plaintext database password via a direct request.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.