A study of 15 vulnerability remediation projects finds only one third of time is actually spent fixing flaws. Here's how to use that extra time more efficiently.
Anonymous: 10 Facts About The Hacktivist Group
(click image for larger view and for slideshow)
It takes less than 10 minutes at the keyboard to fix a cross-site scripting vulnerability, but any company that expects a remediation project to follow a simple calculus is in for a surprise.
On average, the actual programming accounts for only a third of the total time in any effort to fix vulnerabilities, application development expert Daniel Cornell told RSA attendees on Thursday. A principal at the Denim Group, a software security consultancy, Cornell tracked 15 vulnerability remediation projects and discovered that fixing the vulnerability accounted for anywhere from 15 to nearly 60 percent of the total development time, with an average of 29 percent.
"It's not just the time spent on the keyboard that you have to watch out for--there is a lot outside of that as well," he says. "The [vulnerability] may only take five minutes to fix, but then there [are] a lot of other hoops to jump through for--in some cases--the other 85 percent of the time."
Setting up the development environment took up to a third of some remediation projects, while confirming the fixes took up to 44 percent of project time. While the data makes up a small sample size, it can help companies take a better approach to fixing vulnerabilities in their code and reduce the time--and thus, the cost--spent on projects.
With more than two-thirds of a remediation project spent off the keyboard, a good way to reduce costs is to make non-programming activities more efficient, Cornell says. Having an automated way to stand up a development environment can cut, on average, one-sixth off the project time, and efficiently confirming fixes can eliminate another quarter of the overhead.
"In some cases, confirming the fixes and doing quality assurance took longer than fixing the actual vulnerability," Cornell says.
InformationWeek is conducting a survey on information security and risk management. Upon completion of our survey, you will be eligible to enter a drawing to receive an 64-GB Apple iPad 2. Take our Alternative Strategic Security Survey now. Survey ends March 9.
Published: 2014-07-10 Multiple cross-site scripting (XSS) vulnerabilities in group/control_panel/manage in Liferay Portal 6.1.2 CE GA3, 6.1.X EE, and 6.2.X EE allow remote attackers to inject arbitrary web script or HTML via the (1) _2_firstName, (2) _2_lastName, or (3) _2_middleName parameter.
Published: 2014-07-10 The File Transfer feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center does not verify that a requested file was an offered file, which allows remote attackers to read arbitrary files via a modified request, aka Bug IDs CSCup62442 and CSCup58463.
Published: 2014-07-10 Heap-based buffer overflow in the file-sharing feature in WebEx Meetings Client in Cisco WebEx Meetings Server and WebEx Meeting Center allows remote attackers to execute arbitrary code via crafted data, aka Bug IDs CSCup62463 and CSCup58467.
Published: 2014-07-10 Cross-site scripting (XSS) vulnerability in viewfilecontents.do in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote attackers to inject arbitrary web script or HTML via an unspecified parameter, aka Bug ID CSCup76308.
Published: 2014-07-10 The Multiple Analyzer in the Dialed Number Analyzer (DNA) component in Cisco Unified Communications Manager allows remote authenticated users to bypass intended upload restrictions via a crafted parameter, aka Bug ID CSCup76297.