Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

8/13/2019
05:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Orgs Doing More App Security Testing but Fixing Fewer Vulns

On average, US organizations took nearly five months to fix critical vulnerabilities according to WhiteHat Security's annual vulnerability report.

Enterprise organizations are scanning more applications for security vulnerabilities than ever before, but, troublingly, they are remediating fewer of their discoveries because of the sheer volume.

As it has for the past 13 years, WhiteHat Security recently analyzed data from the results of application security tests the company performed at customer locations last year.

The analysis showed that US organizations tested 20% more applications last year for security issues than they did in 2017. Yet they remediated barely half (50.7%) of all critical vulnerabilities discovered in their application software during dynamic application security tests (DAST) in 2018 and just 37% of the high severity flaws.

Despite higher awareness of application security issues, the vulnerability remediation rates last year were actually lower than those reported in 2017 (nearly 57% and 46%, respectively) — which, in turn, was lower than the prior year.

The overall average number of critical vulnerabilities per website was 3.2 — about the same as it has been in the past three years. Information technologies companies ironically had more than double that, at seven critical vulnerabilities per site. Others with an above-average number of critical vulnerabilities on their websites included organizations in the manufacturing sector, with 6.7, retail organizations (6.9) and mining (7).

On average, US organizations took nearly 149 days, or about five months, to fix critical vulnerabilities and some 235 days to fix the ones deemed of high importance. The window of exposure — or the length of time that an application has a serious vulnerability that can be exploited — was especially worrisome among organizations in the IT and retail sectors.  

WhiteHat's data showed that a startling 56.9% of applications in IT organizations and 55.4% of those at companies in the retail sector were always vulnerable to attack.

Suboptimal State
"The state of application security continues to be suboptimal," says Setu Kulkarni, vice president of corporate strategy at WhiteHat Security. "While this is not unexpected, it is surprising given that the number of applications and their criticality is increasing at an unprecedented rate."

Web application security has become a top concern for enterprise organizations. Many recent breaches have resulted from attackers exploiting security flaws in Web applications. A DevSecOps community study that Sonatype conducted earlier this year, in fact, showed that more than one in four organizations (26%) have already experienced a data breach because of a Web application security issue.

In many cases, Sonatype found that the breaches were tied to inherited vulnerabilities in open source and third-party components that software development organizations frequently use in their applications.

WhiteHat's study showed that such embeddable components were responsible for one-third of all discovered application security vulnerabilities last year. The biggest risk to organizations was from using unpatched third-party libraries, which increased 50% in number in just the past year.

"As companies are chasing shorter time to market, they're relying more on open source and third-party components," Kulkarni says. Consequently, production apps are inheriting significant risks. "Organizations need to perform more software composition analysis [SCA] to identify these inherited vulnerabilities before apps are moved into production," he says.

One big takeaway from WhiteHat's report is that companies that implement DevSecOps practices tend to fare significantly better than those that don't. For instance, organizations using a DevSecOps approach had a much higher critical vulnerability remediation rate (89%) compared with companies without one (50.7%).

Only about 22% of the applications in organizations with a formal DevSecOps approach were always vulnerable to threats, compared with 50% of apps, on average, for organizations that didn't use the approach. Similarly, the average time to fix critical vulnerabilities was 22 days in organizations that had implemented DevSecOps, comparedwith 149 days in other organizations.

"The organizations that succeeded in improving their security posture last year are the ones that embraced a robust, phased DevSecOps approach," Kulkarni says.

In such organizations application security testing is embedded into each stage of the development life cycle, he notes. Five years ago, such DevSecOps practices were still more philosophy than practical.

"Now we see it being built into best practices and processes that are measurable and helping organizations improve their security posture," he notes.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-18217
PUBLISHED: 2019-10-21
ProFTPD before 1.3.6b and 1.3.7rc before 1.3.7rc2 allows remote unauthenticated denial-of-service due to incorrect handling of overly long commands because main.c in a child process enters an infinite loop.
CVE-2019-16862
PUBLISHED: 2019-10-21
Reflected XSS in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 allows a remote attacker to execute arbitrary code in the context of a user's session via the pid parameter.
CVE-2019-17409
PUBLISHED: 2019-10-21
Reflected XSS exists in interface/forms/eye_mag/view.php in OpenEMR 5.x before 5.0.2.1 ia the id parameter.
CVE-2019-10715
PUBLISHED: 2019-10-21
There is Stored XSS in Verodin Director before 3.5.4.0 via input fields of certain tooltips, and on the Tags, Sequences, and Actors pages.
CVE-2019-10716
PUBLISHED: 2019-10-21
An Information Disclosure issue in Verodin Director 3.5.3.1 and earlier reveals usernames and passwords of integrated security technologies via a /integrations.json JSON REST API request.