Risk
2/26/2010
02:31 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

State Of Application Security: Nearly 60 Percent Of Apps Fail First Security Test

Veracode app-testing data demonstrates that application security still has a ways to go

SAN FRANCISCO -- RSA Conference 2010 -- Even with all of the emphasis on writing software with security in mind, most software applications remain riddled with security holes, according to a new report released today about the actual security quality of all types of software.

Around 58 percent of the applications tested by application security testing service provider Veracode in the past year-and-a-half failed to achieve a successful rating in their first round of testing. "The degree of failure to meet acceptable standards on first submission is astounding -- and this is coming from folks who care enough to submit their software to our [application security testing] services," says Roger Oberg, senior vice president of marketing for Veracode. "The implication here is that more than half of all applications are susceptible to the kinds of vulnerabilities we saw at Heartland, Google, DoD, and others -- these were all application-layer attacks."

The data for Veracode's State of Software Security Report comes from a combination of static, dynamic, and manual testing of all types of software across multiple programming languages -- everything from non-Web and Web applications to components and shared libraries. Veracode tests commercial, internally developed, open-source, and outsourced applications, all of which were represented in its findings.

And nearly 90 percent of internally developed applications contained vulnerabilities in the SANS Top 25 and OWASP Top 10 lists of most common programming errors and flaws in the first round of tests, Oberg says.

So is software getting more or less secure? Hard to say, Veracode says, since this is the first such report, and there's nothing to compare it to. "We don't know if it's getting better or worse, but it's pretty bad," Oberg says. "Despite all of the awareness about breaches ... this awareness doesn't translate into sufficient action. We hope this report is a call to action."

Around 60 percent of the software tested by Veracode was internally developed applications; 30 percent, commercial applications; 8 percent, open source; and 2 percent, outsourced. The software was 60 percent Web applications, and 40 percent non-Web, according to Veracode, and came from companies across 15 different industries.

Despite the relatively gloomy picture of developers still missing the mark initially on security, there were some bright spots in the report: Open-source software isn't as risky as you'd think, and financial services organizations and government agencies tend to have more secure applications from the get-go; more than half of their apps passed as acceptable in the first submission to testing, according to Veracode's report.

"The conventional wisdom is that open source is risky. But open source was no worse than commercial software upon first submission. That's encouraging," Oberg says. And it was the quickest to remediate any flaws: "It took about 30 days to remediate open-source software, and much longer for commercial and internal projects," he says.

Meanwhile, financial services firms and government agencies were second-best in terms of remediation: They took anywhere from one to two tries to fix their vulnerabilities. "This is good news. But there's a lot of room for improvement," Oberg says.

The data showed that third-party software is often a part of internally developed apps -- 30 percent of them were based on third-party apps.

The vulnerability with the highest total count was cross-site scripting (XSS), and was the third most prevalent flaw. "There's been intense focus on cross-site scripting, and there are lots of different libraries and utilities available to eliminate it, but it's still extremely prevalent," says Chris Eng, director of security research for Veracode. Eng says it's likely due to a lack of education on how to quell XSS, plus it's not uncommon to find 100 XSS bugs in one application. "Cross-site scripting adds up real quickly," he says.

Around 20 percent of the applications carried a SQL injection flaw, and most of those were Web applications. And 44 percent of the apps had one or more cryptographic flaw issue, Eng says. "Crypto issues are not generally well-understood by developers," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
Partner Perspectives
What's This?
In a digital world inundated with advanced security threats, Intel Security seeks to transform how we live and work to keep our information secure. Through hardware and software development, Intel Security delivers robust solutions that integrate security into every layer of every digital device. In combining the security expertise of McAfee with the innovation, performance, and trust of Intel, this vision becomes a reality.

As we rely on technology to enhance our everyday and business life, we must too consider the security of the intellectual property and confidential data that is housed on these devices. As we increase the number of devices we use, we increase the number of gateways and opportunity for security threats. Intel Security takes the “security connected” approach to ensure that every device is secure, and that all security solutions are seamlessly integrated.
Featured Writers
White Papers
Cartoon
Current Issue
Dark Reading's October Tech Digest
Fast data analysis can stymie attacks and strengthen enterprise security. Does your team have the data smarts?
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-7298
Published: 2014-10-24
adsetgroups in Centrify Server Suite 2008 through 2014.1 and Centrify DirectControl 3.x through 4.2.0 on Linux and UNIX allows local users to read arbitrary files with root privileges by leveraging improperly protected setuid functionality.

CVE-2014-8346
Published: 2014-10-24
The Remote Controls feature on Samsung mobile devices does not validate the source of lock-code data received over a network, which makes it easier for remote attackers to cause a denial of service (screen locking with an arbitrary code) by triggering unexpected Find My Mobile network traffic.

CVE-2014-0619
Published: 2014-10-23
Untrusted search path vulnerability in Hamster Free ZIP Archiver 2.0.1.7 allows local users to execute arbitrary code and conduct DLL hijacking attacks via a Trojan horse dwmapi.dll that is located in the current working directory.

CVE-2014-2230
Published: 2014-10-23
Open redirect vulnerability in the header function in adclick.php in OpenX 2.8.10 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the (1) dest parameter to adclick.php or (2) _maxdest parameter to ck.php.

CVE-2014-7281
Published: 2014-10-23
Cross-site request forgery (CSRF) vulnerability in Shenzhen Tenda Technology Tenda A32 Router with firmware 5.07.53_CN allows remote attackers to hijack the authentication of administrators for requests that reboot the device via a request to goform/SysToolReboot.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Follow Dark Reading editors into the field as they talk with noted experts from the security world.