Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

8/25/2016
08:10 AM
Connect Directly
Twitter
RSS
E-Mail
50%
50%

A Temperature-Check On The State Of Application Security

AppSec is more dangerous than network security but receives less than half the funding, according to new Ponemon study.

While most IT and security leaders believe that application security problems are inherently more risky than network security issues, appsec still doesn't get near the same kind of executive support and technical visibility that network security does, a new study out this week by Ponemon Institute shows. Fortunately, new trends in IT delivery like DevOps and continuous integration are making it possible to meet application security challenges that have hampered progress in the past. 

Examining the attitudes and practices of over IT leaders and practitioners, "Application Security in the Changing Risk Landscape" found that the majority of them believe the frequency and severity of attacks against the application layer are greater than against the network layer. Sponsored by F5 Networks, the study reports that 50% of respondents agreed that applications are attacks are more frequent and 58% agreed they are more severe.

The most commonly cited reasons that application-layer attacks are worse than network-layer attacks were that they're harder to detect and more difficult to contain. According to those surveyed, a lack of visibility in the application layer is the top barrier to achieving a strong application security posture.

In spite of the risks and challenges, application security still gets lackluster funding and support. The study shows that only 35% of respondents believe they have ample resources to detect vulnerabilities and 30% say they have enough resources to remediate those vulnerabilities. On average, the network security budget is more than double the application security budget across respondents' organizations.

In spite of a decade plus of strong advocacy for improved testing and mitigation practices within the security industry, most organizations still struggle to test regularly. A quarter of organizations still do no application testing for vulnerabilities at all, and another 33% have no pre-scheduled testing or only test annually. What's more, it appears that many organizations--about a third of them--largely depend upon the stop-gap measure of utilizing web application firewalls as their primary means of securing applications.   

One of the years-long difficulties that have hamstrung efforts to improve application security is that of accountability, due to the large number of stakeholders involved in developing, delivering, and operating software. 

"Fifty-six percent of respondents believe accountability for application security is shifting from IT to the end user or application owner," the report said. "However, at this time responsibility for ensuring the security of applications is dispersed throughout the organization." 

The shift to DevOps and continuous delivery pipelines could go a long way toward automating testing and moving responsibilities closer to the developer so that testing can be done earlier and in a more incremental fashion. About 71% of those surveyed believe that DevOps and continuous delivery stand to improve application delivery. The trick will be in how well testing procedures and technology can be streamlined into the overall automated testing framework.

"I believe that DevOps practices can be highly beneficial to application security as long as security testing is embedded into the automated testing we already do in DevOps to ensure that the apps we develop are both functionally robust and secure from the ground up," says Mike Convertino, CISO for F5.

Ericka Chickowski specializes in coverage of information technology and business innovation. She has focused on information security for the better part of a decade and regularly writes about the security industry as a contributor to Dark Reading.  View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
PZav
50%
50%
PZav,
User Rank: Author
8/30/2016 | 4:45:20 PM
Unsafe Code
It blows my mind that in 2016 there are still enterprises out there that don't vuln scan their apps. It would make me so nervous to have all that code out there twisting in the wind! There has to be business ramifications that aren't fully understood or are being ignored. I can't imagine that any enterprise benefits from ignoring this problem.  
MarkF652
50%
50%
MarkF652,
User Rank: Apprentice
9/12/2016 | 1:22:14 PM
Re: Unsafe Code
Peter - You are spot on.  It is absolutely mindblowing that in 2016, we are still seeing AppSec receive the lack of attention that is deserves.  The short term pseudo-benefit that organizations realize is cost savings, but it only takes once for them to suffer a breach or loss of confidential data and that cost savings quickly reverses.  There really is no excuse, given that this type of effort can almost be 100% outsourced.  Funny enough, I remember, beginning in 2004, that I always thought the current year would be the year of AppSec.  I've been proven wrong, year after year, even though it has certainly garnered a lot of attention since then.  I do believe, as we see a younger generation of executives come online, that we will see a better understanding of the ramifications and the actions to mitigate.  Fingers crossed...

 
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/5/2020
How AI and Automation Can Help Bridge the Cybersecurity Talent Gap
Peter Barker, Chief Product Officer at ForgeRock,  6/1/2020
Cybersecurity Spending Hits 'Temporary Pause' Amid Pandemic
Kelly Jackson Higgins, Executive Editor at Dark Reading,  6/2/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: What? IT said I needed virus protection!
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13864
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from a stored XSS vulnerability. An author user can create posts that result in a stored XSS by using a crafted payload in custom links.
CVE-2020-13865
PUBLISHED: 2020-06-05
The Elementor Page Builder plugin before 2.9.9 for WordPress suffers from multiple stored XSS vulnerabilities. An author user can create posts that result in stored XSS vulnerabilities, by using a crafted link in the custom URL or by applying custom attributes.
CVE-2020-11696
PUBLISHED: 2020-06-05
In Combodo iTop a menu shortcut name can be exploited with a stored XSS payload. This is fixed in all iTop packages (community, essential, professional) in version 2.7.0 and iTop essential and iTop professional in version 2.6.4.
CVE-2020-11697
PUBLISHED: 2020-06-05
In Combodo iTop, dashboard ids can be exploited with a reflective XSS payload. This is fixed in all iTop packages (community, essential, professional) for version 2.7.0 and in iTop essential and iTop professional packages for version 2.6.4.
CVE-2020-13646
PUBLISHED: 2020-06-05
In the cheetah free wifi 5.1 driver file liebaonat.sys, local users are allowed to cause a denial of service (BSOD) or other unknown impact due to failure to verify the value of a specific IOCTL.