66% Of Security Software Submitted With Flaws

App testing firm Veracode reports that developers need significantly more training on secure-coding skills.

(click image for larger view)
Slideshow: 10 Massive Security Breaches
More than two-thirds of security applications and 82% of customer-focused applications initially have an unacceptable level of security quality, compared with just 58% of applications in general.
Thats according to a
report
from Veracode, which analyzed 4,835 applications that were submitted to its application testing service.
Seeing higher numbers of vulnerabilities in security software is especially surprising, since youre buying these applications to perform a security function, so youd expect that these applications would be more secure than others, said Sam King, VP of product marketing for Veracode, in an interview.
The report also found that 80% of all submitted
Web applications
failed to mitigate the top 10 most dangerous vulnerabilities, as identified by the Open Web Application Security Project (OWASP). Interestingly, the Payment Card Industry Data Security Standard also uses the OWASP top 10 list to assess compliance with the standard.
In addition, the report found that since the beginning of 2009,
cross-site scripting vulnerability
volume has remained constant, while SQL injection vulnerabilities have decreased by 2.4% per quarter. Unfortunately, thats not good news, since just one vulnerability can be exploited by an attacker multiple times, across multiple sites, and as numerous reports have found, the number of attacks against Web applications continue to increase.
The good news, however, is that more than 90% of all software products seen by Veracode were resubmitted and went on to achieve an acceptable quality level within a month, while security products reached an acceptable level, on average, in just three days.
That includes more than just Web applications. Overall, the applications assessed by the report were written in Java (52%), .Net (27%), C/C++ (12%), PHP (6%), and ColdFusion (2%), a mix that Veracode said reflects a typical companys application portfolio. In terms of the industries that submitted software, one-third had software designed for content management and collaboration software (33%), followed by operations (25%), security (13%), finance (12%), and customer-centric software (11%).
When it comes to coding clean software, the finance industry remains the sector to beat. Interestingly, the finance and software industries together account for more than 75% of the businesses that require their third-party software suppliers to undergo formal code evaluation. But aerospace and defense are also starting to require much more code verification of suppliers, said King.
Veracode pitches its report as a before picture, compared with reports that assess the damage caused by attackers who exploit software vulnerabilities, for example in the
Verizon Data Breach Investigations Report
.
One sure-fire technique for increasing the quality of code and cutting down on data breaches is to create a
secure development program
with
top-level backing
. But the former part of that equation requires knowledge and expertise on the part of coders. In other words, they need training.
According to the report, many developers dont have secure-coding skills when they get hired, as application security training and education is not a formal part of most computer science curriculums and certainly not a consistent theme in the professional development opportunities made available to technology professionals in companies, it said.

Last News
▸ ArcSight prepares for future at user conference post HP acquisition. ◂ Discovered: 07/01/2025 Category: security	▸ Samsung Epic 4G: First To Use Media Hub ◂ Discovered: 07/01/2025 Category: security	▸ Many third-party software fails security tests ◂ Discovered: 07/01/2025 Category: security

**Cyber Security Categories**
Google Dorks Database	Exploits Vulnerability	Exploit Shellcodes

CVE List

Tools/Apps

News/Aarticles

Phishing Database

Deepfake Detection

Trends/Statistics & Live Infos

Tags:
66% Of Security Software Submitted With Flaws