Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Analytics

4/15/2014
05:30 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
50%
50%

Don't Blame It On The Web Programming Platform

New data shows no one Web development platform generates more vulnerabilities than another -- and website security is still a problem.

The web programming language you pick doesn't dictate your website's security: New data on website vulnerabilities shows that no one platform is more secure than another.

WhiteHat Security's 2014 Website Security Statistics Report published today concludes that .NET accounts for over 28% of websites, followed by Java (25%), and ASP (16%) among more than 30,000 websites. "No languages were more secure than others," says Gabriel Gumbs, a director in WhiteHat Security's solutions architecture group and the lead researcher for the report. Bottom line: There was no major difference in the number of vulnerabilities found among websites using the various languages.

.NET had an average of 11.36 vulnerabilities, followed by Java (11.32), ASP (10.98), Perl (7), and ColdFusion (6).

The report also shows that website security is not improving overall. While website operators are doing a better job at remediating flaws, their applications over time don't necessarily become more bug-free. "In the same breath, new applications are not showing any major improvements over the applications we see year over year. It's about the same, and that's moving backwards," says Gumbs. "The new stuff they are developing isn't necessarily more secure."

Gumbs says that could be the result of new functions or features that introduce complexity, and per usual, more security flaw possibilities.

Chris Eng, vice president of research at Veracode, says WhiteHat's report basically jibes with his company's own data on software vulnerabilities. Its numbers were similar when it came to remediating flaws, for instance, he says. "In our data, we see that certain categories [of bugs] are getting fixed reasonably quickly," says Eng, whose company scans vendors' and other developers' software code for flaws via a cloud-based service.

WhiteHat's Gumbs, meanwhile, says the report's data on legacy applications was most telling. "Their remediation rates were on par with all new applications," he says, pointing to the older ASP platform popular in the financial and insurance industries, according to WhiteHat data.

"A lot of applications you simply can't get rid of," he says.

The most prevalent vulnerability was cross-site scripting, which made a comeback to the top spot after losing its top ranking to information leakage last year. The other four in this year's top five (in order) were information leakage, content spoofing, HTTP response splitting, and predictable resource allocation.

"People are not picking languages based on security implications. That's true and will continue to be true. It's where developers have skillsets and what can get the functionality done," Eng says. "Security is going to be fifth or sixth on the list."

The full WhiteHat report is available for download here

Kelly Jackson Higgins is the Executive Editor of Dark Reading. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
anon6230542982
100%
0%
anon6230542982,
User Rank: Apprentice
4/15/2014 | 9:40:20 PM
It all starts with the C-Level
Anyone in this industry knows that the development language is not the issue, that it is the implementation is the issue, and it all starts with the C suite.

When it comes to secure software development most organizations do the minimal effort required to meet some industry compliance standard such as PCI. They don't do it because they are trying to develop better software.

The C suite cares about one thing and one thing only, short term ROI. They are worried about their quarterly numbers and lack a long term strategy. If they did then they would know secure software development is commitment the whole company has to embrace not just development teams. Its a cultural change in how they do business and write their software.

I have seen company after company think that by performing dynamic and/or static security scans of their software they have implemented a secure software development program that is going to fix their problems. Yet they don't staff the information security teams with people who can validate the findings. They don't educate their developers on how to write secure code. They have no corporate software development policies. Those that do, their CxO has never reviewed any of the development standards to see if they comply with the development policies. They don't audit the development processes to see if they comply with the standards. Developers are left up to their own means to do whatever they want and are never questioned because the C suite would rather claim ignorance, blame technology for their lack of leadership rather than be accountable for something and make a real difference.

If you don't have a C level person in your company who is actively involved with your software development program, setting policies and holding management responsible for cutting corners to get the next version of your product out the door just so they can make their quarterly numbers then you will continue to produce insecure software and it will never get better.
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
4/16/2014 | 8:36:15 AM
Re: It all starts with the C-Level
What you said about the C-level suite not educating programmers on writing secure code is key, @anon6230542982. It's also a cultural issue among coders that somehow needs to be shaken up. As Chris Eng said, "People are not picking languages based on security implications. That's true and will continue to be true. It's where developers have skillsets and what can get the functionality done," Eng says. "Security is going to be fifth or sixth on the list."
GonzSTL
50%
50%
GonzSTL,
User Rank: Ninja
4/16/2014 | 10:06:34 AM
Re: It all starts with the C-Level
I would extend that notion to state that the C-suite must regard all of IT security as a vital part of their organization. If that is the case, then security becomes integrated in every aspect of the organization. Nothing breaks down barriers and objections faster than the knowledge that any initiative or idea is driven down from the top. The key is conveying the message to the C-suite that IT security is vital. There are many organizations that still treat IT security as an afterthought. Look at the breached companies and you will likely find that it is sadly, and frighteningly true.
Navigating Security in the Cloud
Diya Jolly, Chief Product Officer, Okta,  12/4/2019
SOC 2s & Third-Party Assessments: How to Prevent Them from Being Used in a Data Breach Lawsuit
Beth Burgin Waller, Chair, Cybersecurity & Data Privacy Practice , Woods Rogers PLC,  12/5/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: This comment is waiting for review by our moderators.
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-19698
PUBLISHED: 2019-12-10
marc-q libwav through 2017-04-20 has a NULL pointer dereference in wav_content_read() at libwav.c.
CVE-2019-4428
PUBLISHED: 2019-12-09
IBM Watson Assistant for IBM Cloud Pak for Data 1.0.0 through 1.3.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session....
CVE-2019-4611
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to cross-site scripting. This vulnerability allows users to embed arbitrary JavaScript code in the Web UI thus altering the intended functionality potentially leading to credentials disclosure within a trusted session. IBM X-Force ID: 168519.
CVE-2019-4612
PUBLISHED: 2019-12-09
IBM Planning Analytics 2.0 is vulnerable to malicious file upload in the My Account Portal. Attackers can make use of this weakness and upload malicious executable files into the system and it can be sent to victim for performing further attacks. IBM X-Force ID: 168523.
CVE-2019-4621
PUBLISHED: 2019-12-09
IBM DataPower Gateway 7.6.0.0-7 throug 6.0.14 and 2018.4.1.0 through 2018.4.1.5 have a default administrator account that is enabled if the IPMI LAN channel is enabled. A remote attacker could use this account to gain unauthorised access to the BMC. IBM X-Force ID: 168883.