Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Risk

3/13/2013
07:22 PM
Dark Reading
Dark Reading
Products and Releases
50%
50%

99 Percent Of Tested Applications Are Vulnerable To Attacks

Cenzic Trends Report for 2012 also includes a study of mobile security threats

RSA 2013, Campbell, Calif. – March 6, 2013 – Cenzic Inc., the leading provider of application security intelligence to reduce security risks, today released the Cenzic Trends Report for 2012. The report demonstrates that the overwhelming presence of web application vulnerabilities remains a constant problem, with an astounding 99% of applications tested revealing security risks, while additionally shedding light on pressing vulnerabilities within mobile application security.

Gathered during the Cenzic Managed Security team's analysis of applications in production, the report reveals the massive number of vulnerabilities prevalent in web and mobile applications today. The report highlights the type, frequency and severity of vulnerabilities found and predicts which vulnerabilities will pose the greatest risk in web and mobile applications in production throughout 2013.

"Securing the application layer must be addressed more realistically by today's businesses," said Scott Parcel, chief technology officer at Cenzic. "The exposure organizations face from the trove of existing application vulnerabilities and from evolving threats has been laid bare this year, however most organizations have not comprehensively acted to defend themselves from these application level threats. This trend continues to get worse; as the rush to create a multitude of connected mobile apps has led corporations to essentially rip out walls and replace them with unlocked doors, leaving them even less aware of how to secure at scale."

The report also includes a study of mobile security threats, focusing on how data is transferred to, and stored on mobile devices. According to Cenzic's findings, Input Validation (21 percent), Session Management (11 percent) and Privacy Violation (25 percent) combine to account for 57% of mobile vulnerabilities. These results suggest that while storing unencrypted sensitive data on sometimes-lost mobile devices is a significant cause for concern, the often-unsecured web services commonly associated with mobile applications can pose an even bigger risk.

"Businesses are moving into the mobile space for more and more activities--both for their internal and customer-facing applications," continued Bala Venkat, chief marketing officer at Cenzic. "As the mobile space continues to evolve, we are seeing that for all the fear over malware and bots, much of the risk still resides in back-end server communication. Locking down this connection is the key to protecting not just an individual's sensitive information, but that of an entire organization."

Find the full report here: https://info.cenzic.com/2013-Application-Security-Trends-Report.html

Key findings of the Cenzic Trends Report include:

 Cross Site Scripting vulnerabilities rose from 17% in 2011 to 26% in 2012, making it the most common threat over the past year.

 Information Leakage, Session Management and Authentication and Authorization all remained prominent vulnerabilities in 2012

o Information Leakage; 16%

o Session Management; 16%

o Authentication and Authorization; 13%

 The number of vulnerabilities in those applications tested remained high, with a median number of 13 vulnerabilities.

Helpful Links

Cenzic Website

Cenzic Twitter

Cenzic Facebook

About Cenzic

Cenzic provides the leading application security intelligence platform to continuously assess Cloud, Mobile and Web applications to reduce online security risk. Cenzic's solutions scale from single applications to enterprise-level deployments with hybrid approaches that enable testing of applications at optimal levels. Cenzic helps brands of all sizes protect their reputation and manage security risk in the face of malicious attacks. Cenzic's solutions are used in all parts of the software development lifecycle, and most importantly in production, to protect against new threats even after the application has been deployed. Cenzic's application security intelligence platform is architected to handle web, cloud and mobile applications and is the first to provide risk reduction recommendations for business, application developers and specific applications. Today, Cenzic secures more than half a million online applications and trillions of dollars of commerce for Fortune 1000 companies, all major security companies, government agencies, universities and SMBs. More information about Cenzic can be found at www.cenzic.com.

Comment  | 
Print  | 
More Insights
Comments
Threaded  |  Newest First  |  Oldest First
Data Leak Week: Billions of Sensitive Files Exposed Online
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/10/2019
Intel Issues Fix for 'Plundervolt' SGX Flaw
Kelly Jackson Higgins, Executive Editor at Dark Reading,  12/11/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The Year in Security: 2019
This Tech Digest provides a wrap up and overview of the year's top cybersecurity news stories. It was a year of new twists on old threats, with fears of another WannaCry-type worm and of a possible botnet army of Wi-Fi routers. But 2019 also underscored the risk of firmware and trusted security tools harboring dangerous holes that cybercriminals and nation-state hackers could readily abuse. Read more.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-5252
PUBLISHED: 2019-12-14
There is an improper authentication vulnerability in Huawei smartphones (Y9, Honor 8X, Honor 9 Lite, Honor 9i, Y6 Pro). The applock does not perform a sufficient authentication in a rare condition. Successful exploit could allow the attacker to use the application locked by applock in an instant.
CVE-2019-5235
PUBLISHED: 2019-12-14
Some Huawei smart phones have a null pointer dereference vulnerability. An attacker crafts specific packets and sends to the affected product to exploit this vulnerability. Successful exploitation may cause the affected phone to be abnormal.
CVE-2019-5264
PUBLISHED: 2019-12-13
There is an information disclosure vulnerability in certain Huawei smartphones (Mate 10;Mate 10 Pro;Honor V10;Changxiang 7S;P-smart;Changxiang 8 Plus;Y9 2018;Honor 9 Lite;Honor 9i;Mate 9). The software does not properly handle certain information of applications locked by applock in a rare condition...
CVE-2019-5277
PUBLISHED: 2019-12-13
Huawei CloudUSM-EUA V600R006C10;V600R019C00 have an information leak vulnerability. Due to improper configuration, the attacker may cause information leak by successful exploitation.
CVE-2019-5254
PUBLISHED: 2019-12-13
Certain Huawei products (AP2000;IPS Module;NGFW Module;NIP6300;NIP6600;NIP6800;S5700;SVN5600;SVN5800;SVN5800-C;SeMG9811;Secospace AntiDDoS8000;Secospace USG6300;Secospace USG6500;Secospace USG6600;USG6000V;eSpace U1981) have an out-of-bounds read vulnerability. An attacker who logs in to the board m...