Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

4/15/2014
05:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Don't Blame It On The Web Programming Platform

New data shows no one Web development platform generates more vulnerabilities than another -- and website security is still a problem.

The web programming language you pick doesn't dictate your website's security: New data on website vulnerabilities shows that no one platform is more secure than another.

WhiteHat Security's 2014 Website Security Statistics Report published today concludes that .NET accounts for over 28% of websites, followed by Java (25%), and ASP (16%) among more than 30,000 websites. "No languages were more secure than others," says Gabriel Gumbs, a director in WhiteHat Security's solutions architecture group and the lead researcher for the report. Bottom line: There was no major difference in the number of vulnerabilities found among websites using the various languages.

.NET had an average of 11.36 vulnerabilities, followed by Java (11.32), ASP (10.98), Perl (7), and ColdFusion (6).

The report also shows that website security is not improving overall. While website operators are doing a better job at remediating flaws, their applications over time don't necessarily become more bug-free. "In the same breath, new applications are not showing any major improvements over the applications we see year over year. It's about the same, and that's moving backwards," says Gumbs. "The new stuff they are developing isn't necessarily more secure."

Gumbs says that could be the result of new functions or features that introduce complexity, and per usual, more security flaw possibilities.

Chris Eng, vice president of research at Veracode, says WhiteHat's report basically jibes with his company's own data on software vulnerabilities. Its numbers were similar when it came to remediating flaws, for instance, he says. "In our data, we see that certain categories [of bugs] are getting fixed reasonably quickly," says Eng, whose company scans vendors' and other developers' software code for flaws via a cloud-based service.

WhiteHat's Gumbs, meanwhile, says the report's data on legacy applications was most telling. "Their remediation rates were on par with all new applications," he says, pointing to the older ASP platform popular in the financial and insurance industries, according to WhiteHat data.

"A lot of applications you simply can't get rid of," he says.

The most prevalent vulnerability was cross-site scripting, which made a comeback to the top spot after losing its top ranking to information leakage last year. The other four in this year's top five (in order) were information leakage, content spoofing, HTTP response splitting, and predictable resource allocation.

"People are not picking languages based on security implications. That's true and will continue to be true. It's where developers have skillsets and what can get the functionality done," Eng says. "Security is going to be fifth or sixth on the list."

The full WhiteHat report is available for download here

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
anon6230542982
100%
0%
anon6230542982,
User Rank: Apprentice
4/15/2014 | 9:40:20 PM
It all starts with the C-Level
Anyone in this industry knows that the development language is not the issue, that it is the implementation is the issue, and it all starts with the C suite.

When it comes to secure software development most organizations do the minimal effort required to meet some industry compliance standard such as PCI. They don't do it because they are trying to develop better software.

The C suite cares about one thing and one thing only, short term ROI. They are worried about their quarterly numbers and lack a long term strategy. If they did then they would know secure software development is commitment the whole company has to embrace not just development teams. Its a cultural change in how they do business and write their software.

I have seen company after company think that by performing dynamic and/or static security scans of their software they have implemented a secure software development program that is going to fix their problems. Yet they don't staff the information security teams with people who can validate the findings. They don't educate their developers on how to write secure code. They have no corporate software development policies. Those that do, their CxO has never reviewed any of the development standards to see if they comply with the development policies. They don't audit the development processes to see if they comply with the standards. Developers are left up to their own means to do whatever they want and are never questioned because the C suite would rather claim ignorance, blame technology for their lack of leadership rather than be accountable for something and make a real difference.

If you don't have a C level person in your company who is actively involved with your software development program, setting policies and holding management responsible for cutting corners to get the next version of your product out the door just so they can make their quarterly numbers then you will continue to produce insecure software and it will never get better.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/16/2014 | 8:36:15 AM
Re: It all starts with the C-Level
What you said about the C-level suite not educating programmers on writing secure code is key, @anon6230542982. It's also a cultural issue among coders that somehow needs to be shaken up. As Chris Eng said, "People are not picking languages based on security implications. That's true and will continue to be true. It's where developers have skillsets and what can get the functionality done," Eng says. "Security is going to be fifth or sixth on the list."
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
4/16/2014 | 10:06:34 AM
Re: It all starts with the C-Level
I would extend that notion to state that the C-suite must regard all of IT security as a vital part of their organization. If that is the case, then security becomes integrated in every aspect of the organization. Nothing breaks down barriers and objections faster than the knowledge that any initiative or idea is driven down from the top. The key is conveying the message to the C-suite that IT security is vital. There are many organizations that still treat IT security as an afterthought. Look at the breached companies and you will likely find that it is sadly, and frighteningly true.
Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
Exploits Released for As-Yet Unpatched Critical Citrix Flaw
Jai Vijayan, Contributing Writer,  1/13/2020
Microsoft to Officially End Support for Windows 7, Server 2008
Kelly Sheridan, Staff Editor, Dark Reading,  1/13/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
[Just Released] How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7227
PUBLISHED: 2020-01-18
Westermo MRD-315 1.7.3 and 1.7.4 devices have an information disclosure vulnerability that allows an authenticated remote attacker to retrieve the source code of different functions of the web application via requests that lack certain mandatory parameters. This affects ifaces-diag.asp, system.asp, ...
CVE-2019-15625
PUBLISHED: 2020-01-18
A memory usage vulnerability exists in Trend Micro Password Manager 3.8 that could allow an attacker with access and permissions to the victim's memory processes to extract sensitive information.
CVE-2019-19696
PUBLISHED: 2020-01-18
A RootCA vulnerability found in Trend Micro Password Manager for Windows and macOS exists where the localhost.key of RootCA.crt might be improperly accessed by an unauthorized party and could be used to create malicious self-signed SSL certificates, allowing an attacker to misdirect a user to phishi...
CVE-2019-19697
PUBLISHED: 2020-01-18
An arbitrary code execution vulnerability exists in the Trend Micro Security 2019 (v15) consumer family of products which could allow an attacker to gain elevated privileges and tamper with protected services by disabling or otherwise preventing them to start. An attacker must already have administr...
CVE-2019-20357
PUBLISHED: 2020-01-18
A Persistent Arbitrary Code Execution vulnerability exists in the Trend Micro Security 2020 (v160 and 2019 (v15) consumer familiy of products which could potentially allow an attacker the ability to create a malicious program to escalate privileges and attain persistence on a vulnerable system.