Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Application Security

8/13/2019
05:00 PM
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Orgs Doing More App Security Testing but Fixing Fewer Vulns

On average, US organizations took nearly five months to fix critical vulnerabilities according to WhiteHat Security's annual vulnerability report.

Enterprise organizations are scanning more applications for security vulnerabilities than ever before, but, troublingly, they are remediating fewer of their discoveries because of the sheer volume.

As it has for the past 13 years, WhiteHat Security recently analyzed data from the results of application security tests the company performed at customer locations last year.

The analysis showed that US organizations tested 20% more applications last year for security issues than they did in 2017. Yet they remediated barely half (50.7%) of all critical vulnerabilities discovered in their application software during dynamic application security tests (DAST) in 2018 and just 37% of the high severity flaws.

Despite higher awareness of application security issues, the vulnerability remediation rates last year were actually lower than those reported in 2017 (nearly 57% and 46%, respectively) — which, in turn, was lower than the prior year.

The overall average number of critical vulnerabilities per website was 3.2 — about the same as it has been in the past three years. Information technologies companies ironically had more than double that, at seven critical vulnerabilities per site. Others with an above-average number of critical vulnerabilities on their websites included organizations in the manufacturing sector, with 6.7, retail organizations (6.9) and mining (7).

On average, US organizations took nearly 149 days, or about five months, to fix critical vulnerabilities and some 235 days to fix the ones deemed of high importance. The window of exposure — or the length of time that an application has a serious vulnerability that can be exploited — was especially worrisome among organizations in the IT and retail sectors.  

WhiteHat's data showed that a startling 56.9% of applications in IT organizations and 55.4% of those at companies in the retail sector were always vulnerable to attack.

Suboptimal State
"The state of application security continues to be suboptimal," says Setu Kulkarni, vice president of corporate strategy at WhiteHat Security. "While this is not unexpected, it is surprising given that the number of applications and their criticality is increasing at an unprecedented rate."

Web application security has become a top concern for enterprise organizations. Many recent breaches have resulted from attackers exploiting security flaws in Web applications. A DevSecOps community study that Sonatype conducted earlier this year, in fact, showed that more than one in four organizations (26%) have already experienced a data breach because of a Web application security issue.

In many cases, Sonatype found that the breaches were tied to inherited vulnerabilities in open source and third-party components that software development organizations frequently use in their applications.

WhiteHat's study showed that such embeddable components were responsible for one-third of all discovered application security vulnerabilities last year. The biggest risk to organizations was from using unpatched third-party libraries, which increased 50% in number in just the past year.

"As companies are chasing shorter time to market, they're relying more on open source and third-party components," Kulkarni says. Consequently, production apps are inheriting significant risks. "Organizations need to perform more software composition analysis [SCA] to identify these inherited vulnerabilities before apps are moved into production," he says.

One big takeaway from WhiteHat's report is that companies that implement DevSecOps practices tend to fare significantly better than those that don't. For instance, organizations using a DevSecOps approach had a much higher critical vulnerability remediation rate (89%) compared with companies without one (50.7%).

Only about 22% of the applications in organizations with a formal DevSecOps approach were always vulnerable to threats, compared with 50% of apps, on average, for organizations that didn't use the approach. Similarly, the average time to fix critical vulnerabilities was 22 days in organizations that had implemented DevSecOps, comparedwith 149 days in other organizations.

"The organizations that succeeded in improving their security posture last year are the ones that embraced a robust, phased DevSecOps approach," Kulkarni says.

In such organizations application security testing is embedded into each stage of the development life cycle, he notes. Five years ago, such DevSecOps practices were still more philosophy than practical.

"Now we see it being built into best practices and processes that are measurable and helping organizations improve their security posture," he notes.

Related Content:

 

Jai Vijayan is a seasoned technology reporter with over 20 years of experience in IT trade journalism. He was most recently a Senior Editor at Computerworld, where he covered information security and data privacy issues for the publication. Over the course of his 20-year ... View Full Bio
 

Recommended Reading:

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 6/1/2020
Stay-at-Home Orders Coincide With Massive DNS Surge
Robert Lemos, Contributing Writer,  5/27/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Well I dont run on MacOS, so I need to take extra precautions"
Current Issue
How Cybersecurity Incident Response Programs Work (and Why Some Don't)
This Tech Digest takes a look at the vital role cybersecurity incident response (IR) plays in managing cyber-risk within organizations. Download the Tech Digest today to find out how well-planned IR programs can detect intrusions, contain breaches, and help an organization restore normal operations.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-13759
PUBLISHED: 2020-06-02
rust-vmm vm-memory before 0.1.1 and 0.2.x before 0.2.1 allows attackers to cause a denial of service (loss of IP networking) because read_obj and write_obj do not properly access memory. This affects aarch64 (with musl or glibc) and x86_64 (with musl).
CVE-2020-7662
PUBLISHED: 2020-06-02
websocket-extensions npm module prior to 1.0.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other characte...
CVE-2020-7663
PUBLISHED: 2020-06-02
websocket-extensions ruby module prior to 0.1.5 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other charact...
CVE-2020-12017
PUBLISHED: 2020-06-02
GE Grid Solutions Reason RT Clocks, RT430, RT431, and RT434, all firmware versions prior to 08A05. The device’s vulnerability in the web application could allow multiple unauthenticated attacks that could cause serious impact. The vulnerability may allow an unauthenticated attacke...
CVE-2018-18623
PUBLISHED: 2020-06-02
Grafana 5.3.1 has XSS via the "Dashboard > Text Panel" screen. NOTE: this issue exists because of an incomplete fix for CVE-2018-12099.