Cenzic Trends Report 2013 -- 99% Of Apps Tested Have Vulnerabilities

PRESS RELEASE

Campbell, Calif. – March 6, 2013 – Cenzic Inc., the leading provider of application security intelligence to reduce security risks, today released the Cenzic Application Vulnerability Trends Report 2013. The report demonstrates that the overwhelming presence of web application vulnerabilities remains a constant problem, with an astounding 99% of applications tested revealing security risks, while additionally shedding light on pressing vulnerabilities within mobile application security.

Gathered during the Cenzic Managed Security team's analysis of applications in production, the report reveals the massive number of vulnerabilities prevalent in web and mobile applications today. The report highlights the type, frequency and severity of vulnerabilities found and predicts which vulnerabilities will pose the greatest risk in web and mobile applications in production throughout 2013.

"Securing the application layer must be addressed more realistically by today's businesses," said Scott Parcel, chief technology officer at Cenzic. "The exposure that organizations face from the trove of existing application vulnerabilities and from evolving threats has been laid bare this year, however most organizations have not comprehensively acted to defend themselves from these application level threats. This trend continues to get worse; as the rush to create a multitude of connected mobile apps has led corporations to essentially rip out walls and replace them with unlocked doors, leaving them even less aware of how to secure at scale."

The report also includes a study of mobile security threats, focusing on how data is transferred to and stored on mobile devices. According to Cenzic's findings, Input Validation (21 percent), Session Management (11 percent) and Privacy Violation (25 percent) combine to account for 57% of mobile vulnerabilities. These results suggest that while storing unencrypted sensitive data on sometimes-lost mobile devices is a significant cause for concern, the often-unsecured web services commonly associated with mobile applications can pose an even bigger risk.

"Businesses are moving into the mobile space for more and more activities--both for their internal and customer-facing applications," continued Bala Venkat, chief marketing officer at Cenzic. "As the mobile space continues to evolve, we are seeing that for all the fear over malware and bots, much of the risk still resides in back-end server communication. Locking down this connection is the key to protecting not just an individual's sensitive information, but that of an entire organization."

Find the full report here: https://info.cenzic.com/2013-Application-Security-Trends-Report.html

Key findings of the Cenzic Application Vulnerability Trends Report 2013 include:

· Cross Site Scripting vulnerabilities rose from 17% in 2011 to 26% in 2012, making it the most common threat over the past year.

· Information Leakage, Session Management, and Authentication and Authorization all remained prominent vulnerabilities in 2012.

o Information Leakage – 16%

o Session Management – 16%

o Authentication and Authorization – 13%

· The number of vulnerabilities in those applications tested remained high, with a median number of 13 vulnerabilities.