Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

8/13/2019
05:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Orgs Doing More App Security Testing but Fixing Fewer Vulns

On average, US organizations took nearly five months to fix critical vulnerabilities according to WhiteHat Security's annual vulnerability report.

Enterprise organizations are scanning more applications for security vulnerabilities than ever before, but, troublingly, they are remediating fewer of their discoveries because of the sheer volume.

As it has for the past 13 years, WhiteHat Security recently analyzed data from the results of application security tests the company performed at customer locations last year.

The analysis showed that US organizations tested 20% more applications last year for security issues than they did in 2017. Yet they remediated barely half (50.7%) of all critical vulnerabilities discovered in their application software during dynamic application security tests (DAST) in 2018 and just 37% of the high severity flaws.

Despite higher awareness of application security issues, the vulnerability remediation rates last year were actually lower than those reported in 2017 (nearly 57% and 46%, respectively) — which, in turn, was lower than the prior year.

The overall average number of critical vulnerabilities per website was 3.2 — about the same as it has been in the past three years. Information technologies companies ironically had more than double that, at seven critical vulnerabilities per site. Others with an above-average number of critical vulnerabilities on their websites included organizations in the manufacturing sector, with 6.7, retail organizations (6.9) and mining (7).

On average, US organizations took nearly 149 days, or about five months, to fix critical vulnerabilities and some 235 days to fix the ones deemed of high importance. The window of exposure — or the length of time that an application has a serious vulnerability that can be exploited — was especially worrisome among organizations in the IT and retail sectors.  

WhiteHat's data showed that a startling 56.9% of applications in IT organizations and 55.4% of those at companies in the retail sector were always vulnerable to attack.

Suboptimal State
"The state of application security continues to be suboptimal," says Setu Kulkarni, vice president of corporate strategy at WhiteHat Security. "While this is not unexpected, it is surprising given that the number of applications and their criticality is increasing at an unprecedented rate."

Web application security has become a top concern for enterprise organizations. Many recent breaches have resulted from attackers exploiting security flaws in Web applications. A DevSecOps community study that Sonatype conducted earlier this year, in fact, showed that more than one in four organizations (26%) have already experienced a data breach because of a Web application security issue.

In many cases, Sonatype found that the breaches were tied to inherited vulnerabilities in open source and third-party components that software development organizations frequently use in their applications.

WhiteHat's study showed that such embeddable components were responsible for one-third of all discovered application security vulnerabilities last year. The biggest risk to organizations was from using unpatched third-party libraries, which increased 50% in number in just the past year.

"As companies are chasing shorter time to market, they're relying more on open source and third-party components," Kulkarni says. Consequently, production apps are inheriting significant risks. "Organizations need to perform more software composition analysis [SCA] to identify these inherited vulnerabilities before apps are moved into production," he says.

One big takeaway from WhiteHat's report is that companies that implement DevSecOps practices tend to fare significantly better than those that don't. For instance, organizations using a DevSecOps approach had a much higher critical vulnerability remediation rate (89%) compared with companies without one (50.7%).

Only about 22% of the applications in organizations with a formal DevSecOps approach were always vulnerable to threats, compared with 50% of apps, on average, for organizations that didn't use the approach. Similarly, the average time to fix critical vulnerabilities was 22 days in organizations that had implemented DevSecOps, comparedwith 149 days in other organizations.

"The organizations that succeeded in improving their security posture last year are the ones that embraced a robust, phased DevSecOps approach," Kulkarni says.

In such organizations application security testing is embedded into each stage of the development life cycle, he notes. Five years ago, such DevSecOps practices were still more philosophy than practical.

"Now we see it being built into best practices and processes that are measurable and helping organizations improve their security posture," he notes.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Why Cyber-Risk Is a C-Suite Issue
Marc Wilczek, Digital Strategist & CIO Advisor,  11/12/2019
Unreasonable Security Best Practices vs. Good Risk Management
Jack Freund, Director, Risk Science at RiskLens,  11/13/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-14869
PUBLISHED: 2019-11-15
A flaw was found in all versions of ghostscript 9.x before 9.28, where the `.charkeys` procedure, where it did not properly secure its privileged calls, enabling scripts to bypass `-dSAFER` restrictions. An attacker could abuse this flaw by creating a specially crafted PostScript file that could esc...
CVE-2019-18987
PUBLISHED: 2019-11-15
An issue was discovered in the AbuseFilter extension through 1.34 for MediaWiki. Once a specific abuse filter has (accidentally or otherwise) been made public, its previous versions can be exposed, thus potentially disclosing private or sensitive information within the filter's definition.
CVE-2019-18986
PUBLISHED: 2019-11-15
Pimcore before 6.2.2 allow attackers to brute-force (guess) valid usernames by using the 'forgot password' functionality as it returns distinct messages for invalid password and non-existing users.
CVE-2019-18981
PUBLISHED: 2019-11-15
Pimcore before 6.2.2 lacks an Access Denied outcome for a certain scenario of an incorrect recipient ID of a notification.
CVE-2019-18982
PUBLISHED: 2019-11-15
bundles/AdminBundle/Controller/Admin/EmailController.php in Pimcore before 6.3.0 allows script execution in the Email Log preview window because of the lack of a Content-Security-Policy header.