|By Business Wire||
|November 13, 2012 12:00 AM EST||
Veracode, Inc., the leader in cloud-based application security testing, today released the second feature supplement of its annual State of Software Security Report (SoSS), for the first time analyzing third-party software security testing metrics. The data indicates that despite increasing security risks from third-party and externally developed software, few enterprises currently have formal testing programs in place. However, there are signs that more organizations are beginning to recognize and address the security risks associated with externally developed applications.
“The widespread adoption of third-party apps and use of external developers in enterprises brings increased risk,” said Chris Eng, vice president of research, Veracode. “In fact, a typical enterprise has an average of 600 mission-critical applications, about 65 percent of which are developed externally, leaving companies increasingly vulnerable to the security risks found in these apps. We are beginning to see signs that enterprises are recognizing and addressing these risks. However, organizations still assume too much risk when trusting their third-party software suppliers to develop applications that meet industry and organizational standards. There is still much more work to be done to adequately secure the software supply chain.”
The supplement found that some of the most dangerous security flaws in existence, such as SQL injection and Cross-Site Scripting, are among the most prevalent vulnerabilities in third-party vendor applications. The report also showed that while a programmatic approach to software security testing can greatly help enterprises and their vendors mitigate these flaws, few organizations have formal programs in place to manage and secure the software supply chain.
Key findings of the report include:
Currently few enterprises have vendor application security testing
programs in place, but the volume of assessments within organizations
- Less than one in five enterprises have requested a code-level security test from at least one vendor
- However, the volume of vendor-supplied software or application assessments continues to grow with a 49 percent increase from the first quarter of 2011 to the second quarter of 2012
There is a Gap Between Enterprise Standard and Industry Standard
- 38 percent of vendor-supplied applications complied with enterprise-defined policies vs. 10 percent with the OWASP Top Ten and 30 percent with CWE/SANS Top 25 industry-defined standards.
Some of the most dangerous vulnerabilities in vendor applications
are also the most prevalent
- Four of the top five flaw categories for web applications are also among the OWASP Top 10 most dangerous flaws and five of the top six flaw categories for non-web applications appear on the CWE/SANS Top 25 list of most dangerous flaws.
- SQL injection and cross-site scripting affect 40 percent and 71 percent of vendor-supplied web application versions, respectively.
- Only 10 percent of applications tested complied with the OWASP Top Ten list and 30 percent with the CWE/SANS Top 25 industry standards
With 62 percent of applications failing to reach compliance on
first submission, procedures for managing non-compliant applications
are an important aspect of an enterprise’s security policy
- 11 percent of vendors resubmitted new versions of applications for testing but are still out of compliance with enterprise policies
Structured Testing Programs Promote Higher Participation
- Enterprises that relied on an ad-hoc approach when requesting application security testing averaged four participating vendors, whereas enterprises with a structured approach had much higher levels of success, averaging participation from 38 vendors.
- Enterprises with structured programs enabled more vendors to achieve compliance quickly, with 45 percent of vendor applications becoming compliant within one week.
- By contrast, enterprises with an ad hoc program only saw 28 percent of third-party applications achieve compliance within one week
“Today, every organization is an extended enterprise, with third-party software a fundamental layer in the software supply chain,” said Wendy Nather, research director, 451 Research. “It’s critical that organizations develop security policies when purchasing software from outside vendors because of the risks inherent in using third-party applications, yet few are actually demanding security compliance of their suppliers.”
This Study of Enterprise Testing of the Software Supply Chain captures data collected from 939 application versions (across 564 distinct applications) submitted to the Veracode Platform during an 18 month time period from January 201 to June 2012. The data comes from actual security analysis of web and non-web applications across industry verticals, languages and platforms, and represents multiple security testing methodologies on a wide range of application types and programming languages.
The focus of this report is to assess the security of software purchased from vendors, as well as participating in vendor application security testing programs, and how different programs impact vendor compliance with application security policies.
Download the Report
Veracode’s report, Enterprise Testing the Software Supply Chain, examines additional software security topics in the context of application security trends, including details on the industries that most commonly employ assessment programs, more information on the factors involved in time to compliance, and additional facts about the types of security programs that enterprises implement. For complete report findings, download a copy of the report by visiting: https://info.veracode.com/vast-soss.html.
Veracode is the only independent provider of cloud-based application intelligence and security verification services. The Veracode platform provides the fastest, most comprehensive solution to improve the security of internally developed, purchased or outsourced software applications and third-party components. By combining patented static, dynamic and manual testing, extensive eLearning capabilities, and advanced application analytics, Veracode enables scalable, policy-driven application risk management programs that help identify and eradicate numerous vulnerabilities by leveraging best-in-class technologies from vulnerability scanning to penetration testing and static code analysis. Veracode delivers unbiased proof of application security to stakeholders across the software supply chain while supporting independent audit and compliance requirements for all applications no matter how they are deployed, via the web, mobile or in the cloud. Veracode works with customers in more than 80 countries worldwide representing Global 2000 brands. For more information, visit www.veracode.com, follow on Twitter: @Veracode or read the Veracode Blog.
SYS-CON Events announced today Object Management Group® has been named “Media Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
May. 27, 2016 10:00 AM EDT Reads: 2,363
In his session at 18th Cloud Expo, Bruce Swann, Senior Product Marketing Manager at Adobe, will discuss how the Adobe Marketing Cloud can help marketers embrace opportunities for personalized, relevant and real-time customer engagement across offline (direct mail, point of sale, call center) and digital (email, website, SMS, mobile apps, social networks, connected objects). Bruce Swann has more than 15 years of experience working with digital marketing disciplines like web analytics, social med...
May. 27, 2016 10:00 AM EDT Reads: 1,278
SYS-CON Events announced today that Commvault, a global leader in enterprise data protection and information management, has been named “Bronze Sponsor” of SYS-CON's 18th International Cloud Expo, which will take place on June 7–9, 2016, at the Javits Center in New York City, NY, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA. Commvault is a leading provider of data protection and information management...
May. 27, 2016 10:00 AM EDT Reads: 3,077
SYS-CON Events announced today that Tintri Inc., a leading producer of VM-aware storage (VAS) for virtualization and cloud environments, will exhibit at the 18th International CloudExpo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, New York, and the 19th International Cloud Expo, which will take place on November 1–3, 2016, at the Santa Clara Convention Center in Santa Clara, CA.
May. 27, 2016 10:00 AM EDT Reads: 2,293
SYS-CON Events announced today that Hanu Software will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. Leveraging best-in-class people, processes, and technologies, Hanu provides high-quality, high-value software development and business process outsourcing services to independent software vendors (ISVs) and enterprises.
May. 27, 2016 10:00 AM EDT Reads: 1,302
SYS-CON Events announced today that ContentMX, the marketing technology and services company with a singular mission to increase engagement and drive more conversations for enterprise, channel and SMB technology marketers, has been named “Sponsor & Exhibitor Lounge Sponsor” of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2016, at the Javits Center in New York City, New York. “CloudExpo is a great opportunity to start a conversation with new prospects, but what happens after the...
May. 27, 2016 09:45 AM EDT Reads: 1,031
The initial debate is over: Any enterprise with a serious commitment to IT is migrating to the cloud. But things are not so simple. There is a complex mix of on-premises, colocated, and public-cloud deployments. In this power panel at 18th Cloud Expo, moderated by Conference Chair Roger Strukhoff, panelists will look at the present state of cloud from the C-level view, and how great companies and rock star executives can use cloud computing to meet their most ambitious and disruptive business ...
May. 27, 2016 09:45 AM EDT Reads: 2,172
The cloud era has reached the stage where it is no longer a question of whether a company should migrate, but when. Enterprises have embraced the outsourcing of where their various applications are stored and who manages them, saving significant investment along the way. Plus, the cloud has become a defining competitive edge. Companies that fail to successfully adapt risk failure. The media, of course, continues to extol the virtues of the cloud, including how easy it is to get there. Migrating...
May. 27, 2016 09:45 AM EDT Reads: 106
Companies can harness IoT and predictive analytics to sustain business continuity; predict and manage site performance during emergencies; minimize expensive reactive maintenance; and forecast equipment and maintenance budgets and expenditures. Providing cost-effective, uninterrupted service is challenging, particularly for organizations with geographically dispersed operations.
May. 27, 2016 09:00 AM EDT Reads: 1,940
SYS-CON Events announced today that Isomorphic Software will exhibit at SYS-CON's [email protected] at Cloud Expo New York, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. Isomorphic Software provides the SmartClient HTML5/AJAX platform, the most advanced technology for building rich, high-productivity enterprise web applications for any device. SmartClient couples the industry’s broadest, deepest UI component set with a java server framework to deliver an end-...
May. 27, 2016 09:00 AM EDT Reads: 2,095
The IoTs will challenge the status quo of how IT and development organizations operate. Or will it? Certainly the fog layer of IoT requires special insights about data ontology, security and transactional integrity. But the developmental challenges are the same: People, Process and Platform. In his session at @ThingsExpo, Craig Sproule, CEO of Metavine, will demonstrate how to move beyond today's coding paradigm and share the must-have mindsets for removing complexity from the development proc...
May. 27, 2016 09:00 AM EDT Reads: 1,885
SYS-CON Events announced today that AppNeta, the leader in performance insight for business-critical web applications, will exhibit and present at SYS-CON's @DevOpsSummit at Cloud Expo New York, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. AppNeta is the only application performance monitoring (APM) company to provide solutions for all applications – applications you develop internally, business-critical SaaS applications you use and the networks that deli...
May. 27, 2016 09:00 AM EDT Reads: 2,411
What a difference a year makes. Organizations aren’t just talking about IoT possibilities, it is now baked into their core business strategy. With IoT, billions of devices generating data from different companies on different networks around the globe need to interact. From efficiency to better customer insights to completely new business models, IoT will turn traditional business models upside down. In the new customer-centric age, the key to success is delivering critical services and apps wit...
May. 27, 2016 08:45 AM EDT Reads: 1,115
Enterprise networks are complex. Moreover, they were designed and deployed to meet a specific set of business requirements at a specific point in time. But, the adoption of cloud services, new business applications and intensifying security policies, among other factors, require IT organizations to continuously deploy configuration changes. Therefore, enterprises are looking for better ways to automate the management of their networks while still leveraging existing capabilities, optimizing perf...
May. 27, 2016 08:00 AM EDT Reads: 1,251
Join us at Cloud Expo | @ThingsExpo 2016 – June 7-9 at the Javits Center in New York City and November 1-3 at the Santa Clara Convention Center in Santa Clara, CA – and deliver your unique message in a way that is striking and unforgettable by taking advantage of SYS-CON's unmatched high-impact, result-driven event / media packages.
May. 27, 2016 08:00 AM EDT Reads: 2,358
SYS-CON Events announced today that Super Micro Computer, Inc., a global leader in Embedded and IoT solutions, will exhibit at SYS-CON's 18th International Cloud Expo®, which will take place on June 7-9, 2016, at the Javits Center in New York City, NY. Supermicro (NASDAQ: SMCI), the leading innovator in high-performance, high-efficiency server technology, is a premier provider of advanced server Building Block Solutions® for Data Center, Cloud Computing, Enterprise IT, Hadoop/Big Data, HPC and ...
May. 27, 2016 07:45 AM EDT Reads: 481
In his keynote at 18th Cloud Expo, Andrew Keys, Co-Founder of ConsenSys Enterprise, will provide an overview of the evolution of the Internet and the Database and the future of their combination – the Blockchain. Andrew Keys is Co-Founder of ConsenSys Enterprise. He comes to ConsenSys Enterprise with capital markets, technology and entrepreneurial experience. Previously, he worked for UBS investment bank in equities analysis. Later, he was responsible for the creation and distribution of life ...
May. 27, 2016 07:45 AM EDT Reads: 1,913
As cloud and storage projections continue to rise, the number of organizations moving to the cloud is escalating and it is clear cloud storage is here to stay. However, is it secure? Data is the lifeblood for government entities, countries, cloud service providers and enterprises alike and losing or exposing that data can have disastrous results. There are new concepts for data storage on the horizon that will deliver secure solutions for storing and moving sensitive data around the world. ...
May. 27, 2016 07:00 AM EDT Reads: 1,272
The cloud market growth today is largely in public clouds. While there is a lot of spend in IT departments in virtualization, these aren’t yet translating into a true “cloud” experience within the enterprise. What is stopping the growth of the “private cloud” market? In his general session at 18th Cloud Expo, Nara Rajagopalan, CEO of Accelerite, will explore the challenges in deploying, managing, and getting adoption for a private cloud within an enterprise. What are the key differences betwee...
May. 27, 2016 07:00 AM EDT Reads: 1,610
SYS-CON Events announced today that BMC Software has been named "Siver Sponsor" of SYS-CON's 18th Cloud Expo, which will take place on June 7-9, 2015 at the Javits Center in New York, New York. BMC is a global leader in innovative software solutions that help businesses transform into digital enterprises for the ultimate competitive advantage. BMC Digital Enterprise Management is a set of innovative IT solutions designed to make digital business fast, seamless, and optimized from mainframe to mo...
May. 27, 2016 06:45 AM EDT Reads: 2,115