ID: IRCNE2013041811
Date: 2013-04-09
According to "techworld", the software industry’s inability to reduce the number of security flaws in its code is fuelling an age of the ‘everyday hacker’, criminals who can exploit vulnerabilities with a minimum of technical skills, Security testing firm Vercode’s latest State of Software Security (SoSS) report (reg required) has suggested.
Of the 22,430 applications submitted to the firm’s code analysis service in the three 18 months to June 2012, only 13 percent of web applications were able to pass the generic OWASP Top 10 list of security problems.
When it came to standalone applications, only 31 percent complied with the separate CWE/SANS Top 25, a significant decrease on the compliance rate in the previous SoSS report caused, Veracode suggested, by a broader sample of companies using the service.
Nevertheless, the percentage of applications containing common but serious flaws such as SQL injection remained static at 32 percent, with cross-site scripting also stubbornly entrenched at 67 percent.
In short, these failure rates underscore that weak and insecure software development lifecycles are still an issue years after the industry was supposed to have started fixing the problem. Data breaches were an inevitable consequence.
And having failed to eradicate issues such as SQL injection, the ability of non-technical hackers to hunt down and exploit them also augured badly for the industry, Veracode said.
The company predicts that around one in three data breaches during 2013 will be caused by SQL injection alone, one of the easiest for ‘everyday hackers’ to target.
- 2