Vulnerabilities / Threats
3/2/2012
01:03 PM
50%
50%

Security On A Shoestring

A study of 15 vulnerability remediation projects finds only one third of time is actually spent fixing flaws. Here's how to use that extra time more efficiently.

Anonymous: 10 Facts About The Hacktivist Group
Anonymous: 10 Facts About The Hacktivist Group
(click image for larger view and for slideshow)

It takes less than 10 minutes at the keyboard to fix a cross-site scripting vulnerability, but any company that expects a remediation project to follow a simple calculus is in for a surprise.

On average, the actual programming accounts for only a third of the total time in any effort to fix vulnerabilities, application development expert Daniel Cornell told RSA attendees on Thursday. A principal at the Denim Group, a software security consultancy, Cornell tracked 15 vulnerability remediation projects and discovered that fixing the vulnerability accounted for anywhere from 15 to nearly 60 percent of the total development time, with an average of 29 percent.

"It's not just the time spent on the keyboard that you have to watch out for--there is a lot outside of that as well," he says. "The [vulnerability] may only take five minutes to fix, but then there [are] a lot of other hoops to jump through for--in some cases--the other 85 percent of the time."

Setting up the development environment took up to a third of some remediation projects, while confirming the fixes took up to 44 percent of project time. While the data makes up a small sample size, it can help companies take a better approach to fixing vulnerabilities in their code and reduce the time--and thus, the cost--spent on projects.

With more than two-thirds of a remediation project spent off the keyboard, a good way to reduce costs is to make non-programming activities more efficient, Cornell says. Having an automated way to stand up a development environment can cut, on average, one-sixth off the project time, and efficiently confirming fixes can eliminate another quarter of the overhead.

"In some cases, confirming the fixes and doing quality assurance took longer than fixing the actual vulnerability," Cornell says.

Read the rest of this article on Dark Reading.

InformationWeek is conducting a survey on information security and risk management. Upon completion of our survey, you will be eligible to enter a drawing to receive an 64-GB Apple iPad 2. Take our Alternative Strategic Security Survey now. Survey ends March 9.

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7402
Published: 2014-12-17
Multiple unspecified vulnerabilities in request.c in c-icap 0.2.x allow remote attackers to cause a denial of service (crash) via a crafted ICAP request.

CVE-2014-5437
Published: 2014-12-17
Multiple cross-site request forgery (CSRF) vulnerabilities in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allow remote attackers to hijack the authentication of administrators for requests that (1) enable remote management via a request to remote_management.php,...

CVE-2014-5438
Published: 2014-12-17
Cross-site scripting (XSS) vulnerability in ARRIS Touchstone TG862G/CT Telephony Gateway with firmware 7.6.59S.CT and earlier allows remote authenticated users to inject arbitrary web script or HTML via the computer_name parameter to connected_devices_computers_edit.php.

CVE-2014-7170
Published: 2014-12-17
Race condition in Puppet Server 0.2.0 allows local users to obtain sensitive information by accessing it in between package installation or upgrade and the start of the service.

CVE-2014-7285
Published: 2014-12-17
The management console on the Symantec Web Gateway (SWG) appliance before 5.2.2 allows remote authenticated users to execute arbitrary OS commands by injecting command strings into unspecified PHP scripts.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.