Vulnerabilities / Threats

6/26/2015
09:45 AM
Dark Reading
Dark Reading
Products and Releases
50%
50%

Survey: Most Enterprises Don't Fix 60 Percent of Security Vulnerabilities

More than half take three Months to remediate flaws, according to a joint survey by Waratek at Gartner Security and Risk Management Summit

NEW YORK – June 25, 2015 – Waratek, the application protection and management company, today announced the results of a survey conducted at the Gartner Security and Risk Management Summit 2015. Two-thirds of senior security professionals polled said they remediate 40 percent or less of the security vulnerabilities discovered by software application security testing (SAST) tools. Meanwhile, 50 percent of respondents reported that it takes their organization three months (23%) or more (27%) to fix security flaws in their applications.

“We expected the number of known vulnerabilities being fixed by enterprises would be low, but were surprised by the sheer volume that are never addressed. The amount of time it takes to remediate those that are being corrected was even more disturbing,” said Brian Maccaba, CEO of Waratek. “The fact that software application security testing tools are unable to remediate the vulnerabilities they detect is a major reason why organizations are only able to fix 40 percent or less of the flaws they know exist.”

Survey Findings

Waratek surveyed more than 100 security executives and professionals at the recent Gartner Security and Risk Management Summit about their application security testing and remediation practices. According to those polled:

•         The majority (52%) of enterprises test less than half of their applications with SAST tools. More than one third (37%) test less than 20% percent of the applications for vulnerabilities.

•         One-third (36%) of enterprises fix 40% of the vulnerabilities discovered by their SAST tools. Nearly one-third (29%) fix less than 20% of security flaws they know exist.

•         It takes half (50%) of enterprises three months or more to fix security vulnerabilities after they are discovered by SAST tools. Only 11% fix flaws in two weeks or less.

New SAST+RASP Model

Last week, Waratek announced that it has developed the ability for its runtime application self-protection (RASP) product to consume CWE (common weakness enumeration) reports from SAST tools like HP Fortify, Veracode, Checkmarx and others to generate rules that immediately address application security vulnerabilities. This fully automated workflow can immediately protect production applications without any manual intervention or configuration. It can also be integrated into the Software Development Lifecycle. Using a closed-loop process, Waratek AppSecurity for Java provides validation to SAST/DAST tools that vulnerabilities have been remediated.

About Waratek

Waratek makes enterprise apps more secure and easier to manage. Waratek AppSecurity for Java and Waratek Locker provide transparent, runtime application self-protection in datacenter and cloud environments, respectively. Waratek CloudVM enables multiple Java apps to be deployed on a single server for dramatically reduced operating costs. The company was chosen as the Most Innovative Company at RSA Conference 2015, is a SWIFT Innotribe Top Global Innovator and FinTech Innovation Lab winner. Waratek is headquartered in Dublin, Ireland with subsidiaries in New York and London, and offices in Sydney, Tokyo, Shanghai, Taipei and Seoul. For further information please visit www.waratek.com.

 

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Devastating Cyberattack on Email Provider Destroys 18 Years of Data
Jai Vijayan, Freelance writer,  2/12/2019
Up to 100,000 Reported Affected in Landmark White Data Breach
Kelly Sheridan, Staff Editor, Dark Reading,  2/12/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
5 Emerging Cyber Threats to Watch for in 2019
Online attackers are constantly developing new, innovative ways to break into the enterprise. This Dark Reading Tech Digest gives an in-depth look at five emerging attack trends and exploits your security team should look out for, along with helpful recommendations on how you can prevent your organization from falling victim.
Flash Poll
How Enterprises Are Attacking the Cybersecurity Problem
How Enterprises Are Attacking the Cybersecurity Problem
Data breach fears and the need to comply with regulations such as GDPR are two major drivers increased spending on security products and technologies. But other factors are contributing to the trend as well. Find out more about how enterprises are attacking the cybersecurity problem by reading our report today.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-8354
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c has an integer overflow on the result of multiplication fed into malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow.
CVE-2019-8355
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. In xmalloc.h, there is an integer overflow on the result of multiplication fed into the lsx_valloc macro that wraps malloc. When the buffer is allocated, it is smaller than expected, leading to a heap-based buffer overflow in channels_start in remix.c.
CVE-2019-8356
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. One of the arguments to bitrv2 in fft4g.c is not guarded, such that it can lead to write access outside of the statically declared array, aka a stack-based buffer overflow.
CVE-2019-8357
PUBLISHED: 2019-02-15
An issue was discovered in SoX 14.4.2. lsx_make_lpf in effect_i_dsp.c allows a NULL pointer dereference.
CVE-2013-2516
PUBLISHED: 2019-02-15
Vulnerability in FileUtils v0.7, Ruby Gem Fileutils <= v0.7 Command Injection vulnerability in user supplied url variable that is passed to the shell.