Risk

5/16/2013
06:02 AM
50%
50%

Study: Application Vulnerabilities Are No. 1 Threat

Shortage of training among developers is a key cause of high vulnerability rates, (ISC)2 survey says

Application vulnerabilities are the top concern of security professionals, but development teams still are not well-trained in security issues, (ISC)2 warned this week.

In a release published Tuesday, (ISC)2 -- the security industry's largest professional association -- cited data from its recent 2013 Global Information Security Workforce Study, in which 69 percent of security pros rated application vulnerabilities as a high concern -- the highest rating of any threat in the survey.

Insecure software was a contributor in approximately one-third of attributable security breaches, according to the (ISC)2 study.

At the same time, the study cites a lack of security training in the application development process. Only 21 percent of information security professionals are involved in software development, 20 percent in software procurement, and 10 percent in outsourcing, (ISC)2 says. Most respondents (75 percent) become involved during the specification requirements phase of development.

Recent studies from Veracode and Cenzic indicate that most applications, even those that have been deployed for some time, contain security vulnerabilities.

"If we're going to eliminate vulnerabilities, security has to be a part of the development process all the way through, from design to retirement of the application," says Hord Tipton, executive director of (ISC)2. "It can't be bolted on after the application has already been developed."

(ISC)2 has developed the CSSLP, a program for certifying developers and security professionals in application security, but Tipton says it is experiencing slow growth of about 20 percent annually. Unlike (ISC)2's general security certification, the CISSP, the CSSLP is not frequently used as a requirement in hiring, he says.

"Nobody's really demanding that this problem get fixed," Tipton says. Almost half of security organizations in the study said they are not involved in the application development process at all, he notes.

Have a comment on this story? Please click "Add a Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message. Tim Wilson is Editor in Chief and co-founder of Dark Reading.com, UBM Tech's online community for information security professionals. He is responsible for managing the site, assigning and editing content, and writing breaking news stories. Wilson has been recognized as one ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
MROBINSON000
50%
50%
MROBINSON000,
User Rank: Apprentice
5/21/2013 | 12:15:32 PM
re: Study: Application Vulnerabilities Are No. 1 Threat
From a security standpoint, QA professionals have an even more unique role, in that they have the opportunity to apply an SDLC strategy to their craft, and can serve as the point-person for identifying and analyzing where vulnerabilities and bugs exist. ThatGs the reason they are essential to diminish application vulnerabilities. Even more, they represent a unique opportunity to integrate security into software. I recommend checking the article http://blog.securityinnovation...
macker490
50%
50%
macker490,
User Rank: Ninja
5/20/2013 | 11:12:46 AM
re: Study: Application Vulnerabilities Are No. 1 Threat
two faults,-- (1) on authorizing the app install you may authorize improper modification to your o/s -- it that is part of the app install (2) once installed the app can access any of the data available to the user . as a result if the app is compromised it might make improper use of any data it finds on the user system
these problems are present -- even if you are running Linux . the reason being: the start icon does not start the app under a separate user ID . in Linux you can write an AppArmor profile but this is not an easy process .
Linux seems to address the issue with its workspace switcher but sadly that does not require a separate logon for each work space.
WebAuthn, FIDO2 Infuse Browsers, Platforms with Strong Authentication
John Fontana, Standards & Identity Analyst, Yubico,  9/19/2018
NSS Labs Files Antitrust Suit Against Symantec, CrowdStrike, ESET, AMTSO
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/19/2018
Turn the NIST Cybersecurity Framework into Reality: 5 Steps
Mukul Kumar & Anupam Sahai, CISO & VP of Cyber Practice and VP Product Management, Cavirin Systems,  9/20/2018
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: Are you sure this is how we get our data into the cloud?
Current Issue
Flash Poll
The Risk Management Struggle
The Risk Management Struggle
The majority of organizations are struggling to implement a risk-based approach to security even though risk reduction has become the primary metric for measuring the effectiveness of enterprise security strategies. Read the report and get more details today!
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2018-14633
PUBLISHED: 2018-09-25
A security flaw was found in the chap_server_compute_md5() function in the ISCSI target code in the Linux kernel in a way an authentication request from an ISCSI initiator is processed. An unauthenticated remote attacker can cause a stack buffer overflow and smash up to 17 bytes of the stack. The at...
CVE-2018-14647
PUBLISHED: 2018-09-25
Python's elementtree C accelerator failed to initialise Expat's hash salt during initialization. This could make it easy to conduct denial of service attacks against Expat by contructing an XML document that would cause pathological hash collisions in Expat's internal data structures, consuming larg...
CVE-2018-10502
PUBLISHED: 2018-09-24
This vulnerability allows local attackers to escalate privileges on vulnerable installations of Samsung Galaxy Apps Fixed in version 4.2.18.2. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exist...
CVE-2018-11614
PUBLISHED: 2018-09-24
This vulnerability allows remote attackers to escalate privileges on vulnerable installations of Samsung Members Fixed in version 2.4.25. An attacker must first obtain the ability to execute low-privileged code on the target system in order to exploit this vulnerability. The specific flaw exists wit...
CVE-2018-14318
PUBLISHED: 2018-09-24
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Samsung Galaxy S8 G950FXXU1AQL5. User interaction is required to exploit this vulnerability in that the target must have their cellular radios enabled. The specific flaw exists within the handling of ...