Risk

2/26/2010
02:31 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

State Of Application Security: Nearly 60 Percent Of Apps Fail First Security Test

Veracode app-testing data demonstrates that application security still has a ways to go

SAN FRANCISCO -- RSA Conference 2010 -- Even with all of the emphasis on writing software with security in mind, most software applications remain riddled with security holes, according to a new report released today about the actual security quality of all types of software.

Around 58 percent of the applications tested by application security testing service provider Veracode in the past year-and-a-half failed to achieve a successful rating in their first round of testing. "The degree of failure to meet acceptable standards on first submission is astounding -- and this is coming from folks who care enough to submit their software to our [application security testing] services," says Roger Oberg, senior vice president of marketing for Veracode. "The implication here is that more than half of all applications are susceptible to the kinds of vulnerabilities we saw at Heartland, Google, DoD, and others -- these were all application-layer attacks."

The data for Veracode's State of Software Security Report comes from a combination of static, dynamic, and manual testing of all types of software across multiple programming languages -- everything from non-Web and Web applications to components and shared libraries. Veracode tests commercial, internally developed, open-source, and outsourced applications, all of which were represented in its findings.

And nearly 90 percent of internally developed applications contained vulnerabilities in the SANS Top 25 and OWASP Top 10 lists of most common programming errors and flaws in the first round of tests, Oberg says.

So is software getting more or less secure? Hard to say, Veracode says, since this is the first such report, and there's nothing to compare it to. "We don't know if it's getting better or worse, but it's pretty bad," Oberg says. "Despite all of the awareness about breaches ... this awareness doesn't translate into sufficient action. We hope this report is a call to action."

Around 60 percent of the software tested by Veracode was internally developed applications; 30 percent, commercial applications; 8 percent, open source; and 2 percent, outsourced. The software was 60 percent Web applications, and 40 percent non-Web, according to Veracode, and came from companies across 15 different industries.

Despite the relatively gloomy picture of developers still missing the mark initially on security, there were some bright spots in the report: Open-source software isn't as risky as you'd think, and financial services organizations and government agencies tend to have more secure applications from the get-go; more than half of their apps passed as acceptable in the first submission to testing, according to Veracode's report.

"The conventional wisdom is that open source is risky. But open source was no worse than commercial software upon first submission. That's encouraging," Oberg says. And it was the quickest to remediate any flaws: "It took about 30 days to remediate open-source software, and much longer for commercial and internal projects," he says.

Meanwhile, financial services firms and government agencies were second-best in terms of remediation: They took anywhere from one to two tries to fix their vulnerabilities. "This is good news. But there's a lot of room for improvement," Oberg says.

The data showed that third-party software is often a part of internally developed apps -- 30 percent of them were based on third-party apps.

The vulnerability with the highest total count was cross-site scripting (XSS), and was the third most prevalent flaw. "There's been intense focus on cross-site scripting, and there are lots of different libraries and utilities available to eliminate it, but it's still extremely prevalent," says Chris Eng, director of security research for Veracode. Eng says it's likely due to a lack of education on how to quell XSS, plus it's not uncommon to find 100 XSS bugs in one application. "Cross-site scripting adds up real quickly," he says.

Around 20 percent of the applications carried a SQL injection flaw, and most of those were Web applications. And 44 percent of the apps had one or more cryptographic flaw issue, Eng says. "Crypto issues are not generally well-understood by developers," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Higher Education: 15 Books to Help Cybersecurity Pros Be Better
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
'PowerSnitch' Hacks Androids via Power Banks
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/8/2018
Worst Password Blunders of 2018 Hit Organizations East and West
Curtis Franklin Jr., Senior Editor at Dark Reading,  12/12/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
10 Best Practices That Could Reshape Your IT Security Department
This Dark Reading Tech Digest, explores ten best practices that could reshape IT security departments.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-1848
PUBLISHED: 2018-12-14
IBM Business Automation Workflow 18.0.0.0 and 18.0.0.1 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ...
CVE-2018-1977
PUBLISHED: 2018-12-14
IBM DB2 for Linux, UNIX and Windows 11.1 (includes DB2 Connect Server) contains a denial of service vulnerability. A remote, authenticated DB2 user could exploit this vulnerability by issuing a specially-crafted SELECT statement with TRUNCATE function. IBM X-Force ID: 154032.
CVE-2018-18006
PUBLISHED: 2018-12-14
Hardcoded credentials in the Ricoh myPrint application 2.9.2.4 for Windows and 2.2.7 for Android give access to any externally disclosed myPrint WSDL API, as demonstrated by discovering API secrets of related Google cloud printers, encrypted passwords of mail servers, and names of printed files.
CVE-2018-18984
PUBLISHED: 2018-12-14
Medtronic CareLink 2090 Programmer CareLink 9790 Programmer 29901 Encore Programmer, all versions, The affected products do not encrypt or do not sufficiently encrypt the following sensitive information while at rest PII and PHI.
CVE-2018-19003
PUBLISHED: 2018-12-14
GE Mark VIe, EX2100e, EX2100e_Reg, and LS2100e Versions 03.03.28C to 05.02.04C, EX2100e All versions prior to v04.09.00C, EX2100e_Reg All versions prior to v04.09.00C, and LS2100e All versions prior to v04.09.00C The affected versions of the application have a path traversal vulnerability that fails...