Over 60% Of Breaches Tied To Flaws In Business-Critical ApplicationsOver 60% Of Breaches Tied To Flaws In Business-Critical Applications
Survey by Forrester Consulting and Veracode shows businesses struggling to stay on top of application security
April 15, 2009
If you still don't think security vulnerabilities in software will necessarily catch up with you, think again: 62 percent of organizations in the last 12 months suffered data breaches as a result of bugs being exploited in their major applications, according to a newly released survey.
Forrester Consulting, commissioned by Veracode, surveyed application developers and security and risk professionals in 200 organizations in the U.S. and U.K., and found that secure software development programs are rare -- only 34 percent said they have a software development lifecycle program that integrates security.
"The survey showed that people, process, and culture are the primary inhibitors," says Matt Moynahan, CEO of Veracode, in an interview. "Security is not a core competence of enterprises developing code."
Application security awareness is hot today, with multiple new industry initiatives aimed at promoting and helping companies write more secure code.
But the current economic crisis is putting the squeeze on those organizations trying to improve their application security. Around 45 percent said application security is a big piece of their overall security strategy, but that they will likely scale back those initiatives in their next budget cycle. Close to 20 percent say their funding for application security will remain intact, according to the report.
Meanwhile, 57 percent don't have application security training programs for their in-house developers, and only 13 percent said they know the security quality of all of their mission-critical applications. But they are vetting the security of software they purchase, as 60 percent say they use or are about to use third-party security assessments as part of the procurement process.
The key inhibitors to deploying an application security risk management program in-house were people and processes, according to Veracode, each of which got around 80 percent of the votes.
Veracode and Forrester will discuss the complete findings in the survey in a Webinar on May 7 at 1pm ET.
Have a comment on this story? Please click "Discuss" below. If you'd like to contact Dark Reading's editors directly, send us a message.
About the Author(s)
You May Also Like
How to Combat the Latest Cloud Security ThreatsNov 06, 2023
Reducing Cyber Risk in Enterprise Email Systems: It's Not Just Spam and PhishingNov 01, 2023
SecOps & DevSecOps in the CloudNov 06, 2023
What's In Your Cloud?Nov 30, 2023
Everything You Need to Know About DNS AttacksNov 30, 2023
Passwords Are Passe: Next Gen Authentication Addresses Today's Threats
How to Use Threat Intelligence to Mitigate Third-Party Risk
Concerns Mount Over Ransomware, Zero-Day Bugs, and AI-Enabled Malware
Everything You Need to Know About DNS Attacks
Securing the Remote Worker: How to Mitigate Off-Site Cyberattacks
9 Traits You Need to Succeed as a Cybersecurity Leader
The Ultimate Guide to the CISSP
AI in Cybersecurity: Using artificial intelligence to mitigate emerging security risks
Defending Corporate Executives and VIPs from Cyberattacks
Building Immunity: The 2021 Healthcare and Pharmaceutical Industry Cyber Threat Landscape Report