Security On A Shoestring

Anonymous: 10 Facts About The Hacktivist Group

It takes less than 10 minutes at the keyboard to fix a cross-site scripting vulnerability, but any company that expects a remediation project to follow a simple calculus is in for a surprise.

On average, the actual programming accounts for only a third of the total time in any effort to fix vulnerabilities, application development expert Daniel Cornell told RSA attendees on Thursday. A principal at the Denim Group, a software security consultancy, Cornell tracked 15 vulnerability remediation projects and discovered that fixing the vulnerability accounted for anywhere from 15 to nearly 60 percent of the total development time, with an average of 29 percent.

"It's not just the time spent on the keyboard that you have to watch out for--there is a lot outside of that as well," he says. "The [vulnerability] may only take five minutes to fix, but then there [are] a lot of other hoops to jump through for--in some cases--the other 85 percent of the time."

Setting up the development environment took up to a third of some remediation projects, while confirming the fixes took up to 44 percent of project time. While the data makes up a small sample size, it can help companies take a better approach to fixing vulnerabilities in their code and reduce the time--and thus, the cost--spent on projects.

With more than two-thirds of a remediation project spent off the keyboard, a good way to reduce costs is to make non-programming activities more efficient, Cornell says. Having an automated way to stand up a development environment can cut, on average, one-sixth off the project time, and efficiently confirming fixes can eliminate another quarter of the overhead.

"In some cases, confirming the fixes and doing quality assurance took longer than fixing the actual vulnerability," Cornell says.

Read the rest of this article on Dark Reading.

InformationWeek is conducting a survey on information security and risk management. Upon completion of our survey, you will be eligible to enter a drawing to receive an 64-GB Apple iPad 2. Take our Alternative Strategic Security Survey now. Survey ends March 9.