Most applications 'suffer from information leakage bugs'

News by Rene Millman

Apps prone to leakage bugs, cryptographic problems, poor code quality and CRLF Injection vulnerabilities, according to new report from CA Veracode.

Over half of applications suffer from information leakage, cryptographic problems, poor code quality and CRLF Injection flaws, according to a new report.

The recently published 2018 State of Software Security report by CA Veracode found that information leakage bugs were found in 66.8 percent of tested applications, while cryptographic issues plagued 63.7 percent of apps.

The report also found that poor code quality affected 63.1 percent of applications while CRLF injection issues cropped up in 59.5 percent of apps.

The report said that that this particular distribution of common vulnerabilities was found through Static Analysis Security Testing (SAST), which examines code in a non-runtime environment.

"We’ve largely focused our data analysis on SAST results because we believe it is more statistically reflective of the high-level efficacy of AppSec during the SDLC," said the report’s authors. "Static testing is more commonly done earlier in the SDLC, whereas dynamic tests are done later in the lifecycle for a variety of reasons, including the length of time it takes to test dynamically."

The report found that Europe, the Middle East and Africa is behind the rest of the regions in the world when closing out vulnerabilities. However, in the UK, organisations were quick to find and fix vulnerabilities, closing on a quarter of flaws in just 11 days – the second best among eight countries.

The UK also closed 50 per cent of flaws in 72 days and closed 75 percent of flaws in 304 days. These marks outpaced averages across regions. Companies in Asia Pacific (APAC) are the quickest to remediate, closing out 25 percent of their flaws in about eight days, followed by 22 days for the Americas and 28 days for those in Europe and the Middle East (EMEA). 

But things in general were improving when it came to squashing bugs. According to the report, 69 percent of flaws discovered were closed through remediation or mitigation, an increase of nearly 12 percent since the previous report. The authors of the report said this shows organisations are gaining prowess in closing newly discovered vulnerabilities, which hackers often seek to exploit.  

Despite this progress, the new SOSS report also shows that the number of vulnerable apps remains staggeringly high, and open source components continue to present significant risks to businesses. More than 85 percent of all applications contain at least one vulnerability following the first scan, and more than 13 percent of applications contain at least one very high severity flaw. In addition, organisations’ latest scan results indicate that one in three applications were vulnerable to attack through high or very high severity flaws.

"Security-minded organisations have recognised that embedding security design and testing directly into the continuous software delivery cycle is essential to achieving the DevSecOps principles of balance of speed, flexibility and risk management. Until now, it’s been challenging to pinpoint the benefits of this approach, but this latest State of Software Security report provides hard evidence that organisations with more frequent scans are fixing flaws more quickly," said Chris Eng, vice president of research at CA Veracode.

"These incremental improvements amount over time to a significant advantage in competitiveness in the market and a huge drop in risk associated with vulnerabilities." 

Find this article useful?

Get more great articles like this in your inbox every lunchtime

Video and interviews