[Infowarrior] - 60 Percent Of Apps Fail First Security Test

[Richard Forno]

  State Of Application Security: Nearly 60 Percent Of Apps Fail First  
Security Test

Veracode app-testing data demonstrates that application security still  
has a ways to go
Mar 01, 2010 | 09:00 AM

By Kelly Jackson Higgins
DarkReading

http://www.darkreading.com/vulnerability_management/security/app-security/showArticle.jhtml
SAN FRANCISCO -- RSA Conference 2010 -- Even with all of the emphasis  
on writing software with security in mind, most software applications  
remain riddled with security holes, according to a new report released  
today about the actual security quality of all types of software.

Around 58 percent of the applications tested by application security  
testing service provider Veracode in the past year-and-a-half failed  
to achieve a successful rating in their first round of testing. "The  
degree of failure to meet acceptable standards on first submission is  
astounding -- and this is coming from folks who care enough to submit  
their software to our [application security testing] services," says  
Roger Oberg, senior vice president of marketing for Veracode. "The  
implication here is that more than half of all applications are  
susceptible to the kinds of vulnerabilities we saw at Heartland,  
Google, DoD, and others -- these were all application-layer attacks."

The data for Veracode's State of Software Security Report comes from a  
combination of static, dynamic, and manual testing of all types of  
software across multiple programming languages -- everything from non- 
Web and Web applications to components and shared libraries. Veracode  
tests commercial, internally developed, open-source, and outsourced  
applications, all of which were represented in its findings.

And nearly 90 percent of internally developed applications contained  
vulnerabilities in the SANS Top 25 and OWASP Top 10 lists of most  
common programming errors and flaws in the first round of tests, Oberg  
says.

So is software getting more or less secure? Hard to say, Veracode  
says, since this is the first such report, and there's nothing to  
compare it to. "We don't know if it's getting better or worse, but  
it's pretty bad," Oberg says. "Despite all of the awareness about  
breaches ... this awareness doesn't translate into sufficient action.  
We hope this report is a call to action."

Around 60 percent of the software tested by Veracode was internally  
developed applications; 30 percent, commercial applications; 8  
percent, open source; and 2 percent, outsourced. The software was 60  
percent Web applications, and 40 percent non-Web, according to  
Veracode, and came from companies across 15 different industries.

Despite the relatively gloomy picture of developers still missing the  
mark initially on security, there were some bright spots in the  
report: Open-source software isn't as risky as you'd think, and  
financial services organizations and government agencies tend to have  
more secure applications from the get-go; more than half of their apps  
passed as acceptable in the first submission to testing, according to  
Veracode's report.

"The conventional wisdom is that open source is risky. But open source  
was no worse than commercial software upon first submission. That's  
encouraging," Oberg says. And it was the quickest to remediate any  
flaws: "It took about 30 days to remediate open-source software, and  
much longer for commercial and internal projects," he says.

Meanwhile, financial services firms and government agencies were  
second-best in terms of remediation: They took anywhere from one to  
two tries to fix their vulnerabilities. "This is good news. But  
there's a lot of room for improvement," Oberg says.

The data showed that third-party software is often a part of  
internally developed apps -- 30 percent of them were based on third- 
party apps.

The vulnerability with the highest total count was cross-site  
scripting (XSS), and was the third most prevalent flaw. "There's been  
intense focus on cross-site scripting, and there are lots of different  
libraries and utilities available to eliminate it, but it's still  
extremely prevalent," says Chris Eng, director of security research  
for Veracode. Eng says it's likely due to a lack of education on how  
to quell XSS, plus it's not uncommon to find 100 XSS bugs in one  
application. "Cross-site scripting adds up real quickly," he says.

Around 20 percent of the applications carried a SQL injection flaw,  
and most of those were Web applications. And 44 percent of the apps  
had one or more cryptographic flaw issue, Eng says. "Crypto issues are  
not generally well-understood by developers," he says.