Cyber security is a massive challenge for organisations in every industry, which are dealing with a massive volume of open flaws that need to be addressed. But DevSecOps is helping to drive improvements in taking action.
According to a new report, 69% of flaws discovered were closed through remediation or mitigation, an increase of nearly 12%, indicating that organisations are gaining prowess in closing newly discovered vulnerabilities, which hackers often seek to exploit.
CA Veracode’s latest State of Software Security (SOSS) report includes promising signs that DevSecOps is facilitating better security and efficiency, and provides the industry with the company’s first look at flaw persistence analysis, which measures the longevity of flaws after first discovery.
Despite the progress, the new SOSS report also shows that the number of vulnerable apps remains staggeringly high, and open source components continue to present significant risks to businesses.
More than 85% of all applications contain at least one vulnerability following the first scan, and more than 13% of applications contain at least one very high severity flaw. In addition, organisations’ latest scan results indicate that one in three applications were vulnerable to attack through high or very high severity flaws.
An examination of fix rates across 2-trillion lines of code shows that companies face extended application risk exposure due to persisting flaws:
* More than 70% of all flaws remained one month after discovery and nearly 55% remained three months after discovery.
* 25% of high and very high severity flaws were not addressed within 290 days of discovery.
* Overall, 25% of flaws were fixed within 21 days, while the final 25% remained open, well after a year of discovery.
“Security-minded organisations have recognised that embedding security design and testing directly into the continuous software delivery cycle is essential to achieving the DevSecOps principles of balance of speed, flexibility and risk management,” says Chris Eng, vice-president of research at CA Veracode. “Until now, it’s been challenging to pinpoint the benefits of this approach, but this latest State of Software Security report provides hard evidence that organisations with more frequent scans are fixing flaws more quickly.
“These incremental improvements amount over time to a significant advantage in competitiveness in the market and a huge drop in risk associated with vulnerabilities.”
In its third consecutive year documenting DevSecOps practices, the SOSS analysis shows a strong correlation between high rates of security scanning and lower long-term application risks, presenting significant evidence for the efficacy of DevSecOps.
CA Veracode’s data on flaw persistence shows that organisations with established DevSecOps programs and practices greatly outperform their peers in how quickly they address flaws.
The most active DevSecOps programs fix flaws more than 11,5 times faster than the typical organisation, due to ongoing security checks during continuous delivery of software builds, largely the result of increased code scanning.
The data shows a very strong correlation between how many times a year an organisation scans and how quickly they address their vulnerabilities.
In prior SOSS reports, data has shown that vulnerable open source software components run rampant within most software. The current SOSS report found that most applications were still rife with flawed components, though there has been some improvement on the Java front. Whereas last year about 88% of Java applications had at least one vulnerability in a component, it fell to just over 77% in this report.
As organisations tackle bug-ridden components, they should consider not just the open flaws within libraries and frameworks, but also how they are using those components. By understanding not just the status of the component, but whether or not a vulnerable method is being called, organisations can pinpoint their component risk and prioritise fixes based on the riskiest uses of components.