Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

Security On A Shoestring

A study of 15 vulnerability remediation projects finds only one third of time is actually spent fixing flaws. Here's how to use that extra time more efficiently.

Anonymous: 10 Facts About The Hacktivist Group
Anonymous: 10 Facts About The Hacktivist Group
(click image for larger view and for slideshow)

It takes less than 10 minutes at the keyboard to fix a cross-site scripting vulnerability, but any company that expects a remediation project to follow a simple calculus is in for a surprise.

On average, the actual programming accounts for only a third of the total time in any effort to fix vulnerabilities, application development expert Daniel Cornell told RSA attendees on Thursday. A principal at the Denim Group, a software security consultancy, Cornell tracked 15 vulnerability remediation projects and discovered that fixing the vulnerability accounted for anywhere from 15 to nearly 60 percent of the total development time, with an average of 29 percent.

"It's not just the time spent on the keyboard that you have to watch out for--there is a lot outside of that as well," he says. "The [vulnerability] may only take five minutes to fix, but then there [are] a lot of other hoops to jump through for--in some cases--the other 85 percent of the time."

Setting up the development environment took up to a third of some remediation projects, while confirming the fixes took up to 44 percent of project time. While the data makes up a small sample size, it can help companies take a better approach to fixing vulnerabilities in their code and reduce the time--and thus, the cost--spent on projects.

With more than two-thirds of a remediation project spent off the keyboard, a good way to reduce costs is to make non-programming activities more efficient, Cornell says. Having an automated way to stand up a development environment can cut, on average, one-sixth off the project time, and efficiently confirming fixes can eliminate another quarter of the overhead.

"In some cases, confirming the fixes and doing quality assurance took longer than fixing the actual vulnerability," Cornell says.

Read the rest of this article on Dark Reading.

InformationWeek is conducting a survey on information security and risk management. Upon completion of our survey, you will be eligible to enter a drawing to receive an 64-GB Apple iPad 2. Take our Alternative Strategic Security Survey now. Survey ends March 9.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Sodinokibi Ransomware: Where Attackers' Money Goes
Kelly Sheridan, Staff Editor, Dark Reading,  10/15/2019
Data Privacy Protections for the Most Vulnerable -- Children
Dimitri Sirota, Founder & CEO of BigID,  10/17/2019
State of SMB Insecurity by the Numbers
Ericka Chickowski, Contributing Writer,  10/17/2019
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
7 Threats & Disruptive Forces Changing the Face of Cybersecurity
This Dark Reading Tech Digest gives an in-depth look at the biggest emerging threats and disruptive forces that are changing the face of cybersecurity today.
Flash Poll
2019 Online Malware and Threats
2019 Online Malware and Threats
As cyberattacks become more frequent and more sophisticated, enterprise security teams are under unprecedented pressure to respond. Is your organization ready?
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2019-17424
PUBLISHED: 2019-10-22
A stack-based buffer overflow in the processPrivilage() function in IOS/process-general.c in nipper-ng 0.11.10 allows remote attackers (serving firewall configuration files) to achieve Remote Code Execution or Denial Of Service via a crafted file.
CVE-2019-16404
PUBLISHED: 2019-10-21
Authenticated SQL Injection in interface/forms/eye_mag/js/eye_base.php in OpenEMR through 5.0.2 allows a user to extract arbitrary data from the openemr database via a non-parameterized INSERT INTO statement, as demonstrated by the providerID parameter.
CVE-2019-17400
PUBLISHED: 2019-10-21
The unoconv package before 0.9 mishandles untrusted pathnames, leading to SSRF and local file inclusion.
CVE-2019-17498
PUBLISHED: 2019-10-21
In libssh2 v1.9.0 and earlier versions, the SSH_MSG_DISCONNECT logic in packet.c has an integer overflow in a bounds check, enabling an attacker to specify an arbitrary (out-of-bounds) offset for a subsequent memory read. A crafted SSH server may be able to disclose sensitive information or cause a ...
CVE-2019-16969
PUBLISHED: 2019-10-21
In FusionPBX up to 4.5.7, the file app\fifo_list\fifo_interactive.php uses an unsanitized "c" variable coming from the URL, which is reflected in HTML, leading to XSS.