Risk
2/26/2010
02:31 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

State Of Application Security: Nearly 60 Percent Of Apps Fail First Security Test

Veracode app-testing data demonstrates that application security still has a ways to go

SAN FRANCISCO -- RSA Conference 2010 -- Even with all of the emphasis on writing software with security in mind, most software applications remain riddled with security holes, according to a new report released today about the actual security quality of all types of software.

Around 58 percent of the applications tested by application security testing service provider Veracode in the past year-and-a-half failed to achieve a successful rating in their first round of testing. "The degree of failure to meet acceptable standards on first submission is astounding -- and this is coming from folks who care enough to submit their software to our [application security testing] services," says Roger Oberg, senior vice president of marketing for Veracode. "The implication here is that more than half of all applications are susceptible to the kinds of vulnerabilities we saw at Heartland, Google, DoD, and others -- these were all application-layer attacks."

The data for Veracode's State of Software Security Report comes from a combination of static, dynamic, and manual testing of all types of software across multiple programming languages -- everything from non-Web and Web applications to components and shared libraries. Veracode tests commercial, internally developed, open-source, and outsourced applications, all of which were represented in its findings.

And nearly 90 percent of internally developed applications contained vulnerabilities in the SANS Top 25 and OWASP Top 10 lists of most common programming errors and flaws in the first round of tests, Oberg says.

So is software getting more or less secure? Hard to say, Veracode says, since this is the first such report, and there's nothing to compare it to. "We don't know if it's getting better or worse, but it's pretty bad," Oberg says. "Despite all of the awareness about breaches ... this awareness doesn't translate into sufficient action. We hope this report is a call to action."

Around 60 percent of the software tested by Veracode was internally developed applications; 30 percent, commercial applications; 8 percent, open source; and 2 percent, outsourced. The software was 60 percent Web applications, and 40 percent non-Web, according to Veracode, and came from companies across 15 different industries.

Despite the relatively gloomy picture of developers still missing the mark initially on security, there were some bright spots in the report: Open-source software isn't as risky as you'd think, and financial services organizations and government agencies tend to have more secure applications from the get-go; more than half of their apps passed as acceptable in the first submission to testing, according to Veracode's report.

"The conventional wisdom is that open source is risky. But open source was no worse than commercial software upon first submission. That's encouraging," Oberg says. And it was the quickest to remediate any flaws: "It took about 30 days to remediate open-source software, and much longer for commercial and internal projects," he says.

Meanwhile, financial services firms and government agencies were second-best in terms of remediation: They took anywhere from one to two tries to fix their vulnerabilities. "This is good news. But there's a lot of room for improvement," Oberg says.

The data showed that third-party software is often a part of internally developed apps -- 30 percent of them were based on third-party apps.

The vulnerability with the highest total count was cross-site scripting (XSS), and was the third most prevalent flaw. "There's been intense focus on cross-site scripting, and there are lots of different libraries and utilities available to eliminate it, but it's still extremely prevalent," says Chris Eng, director of security research for Veracode. Eng says it's likely due to a lack of education on how to quell XSS, plus it's not uncommon to find 100 XSS bugs in one application. "Cross-site scripting adds up real quickly," he says.

Around 20 percent of the applications carried a SQL injection flaw, and most of those were Web applications. And 44 percent of the apps had one or more cryptographic flaw issue, Eng says. "Crypto issues are not generally well-understood by developers," he says.

Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message. Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-6306
Published: 2014-08-22
Unspecified vulnerability on IBM Power 7 Systems 740 before 740.70 01Ax740_121, 760 before 760.40 Ax760_078, and 770 before 770.30 01Ax770_062 allows local users to gain Service Processor privileges via unknown vectors.

CVE-2014-0232
Published: 2014-08-22
Multiple cross-site scripting (XSS) vulnerabilities in framework/common/webcommon/includes/messages.ftl in Apache OFBiz 11.04.01 before 11.04.05 and 12.04.01 before 12.04.04 allow remote attackers to inject arbitrary web script or HTML via unspecified vectors, which are not properly handled in a (1)...

CVE-2014-3525
Published: 2014-08-22
Unspecified vulnerability in Apache Traffic Server 4.2.1.1 and 5.x before 5.0.1 has unknown impact and attack vectors, possibly related to health checks.

CVE-2014-3563
Published: 2014-08-22
Multiple unspecified vulnerabilities in Salt (aka SaltStack) before 2014.1.10 allow local users to have an unspecified impact via vectors related to temporary file creation in (1) seed.py, (2) salt-ssh, or (3) salt-cloud.

CVE-2014-3594
Published: 2014-08-22
Cross-site scripting (XSS) vulnerability in the Host Aggregates interface in OpenStack Dashboard (Horizon) before 2013.2.4, 2014.1 before 2014.1.2, and Juno before Juno-3 allows remote administrators to inject arbitrary web script or HTML via a new host aggregate name.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Three interviews on critical embedded systems and security, recorded at Black Hat 2014 in Las Vegas.