CA Veracode's latest State of Software Security Report finds organisations implementing DevSecOps address flaws 11x faster than others

First Veracode analysis of flaw persistence finds one in four flaws remain open more than a year after discovery.

CA Veracode, part of CA Technologies' industry-leading security portfolio, has released the latest State of Software Security (SOSS) report. The study includes promising signs that DevSecOps is facilitating better security and efficiency, and provides the industry with the company's first look at flaw persistence analysis, which measures the longevity of flaws after first discovery.

State of software security improving

In every industry, organisations are dealing with a massive volume of open flaws to address, and they are showing improvement in taking action against what they find. According to the report, 69% of flaws discovered were closed through remediation or mitigation, an increase of nearly 12% since the previous report. This shows organisations are gaining prowess in closing newly discovered vulnerabilities, which hackers often seek to exploit.

Despite this progress, the new SOSS report also shows the number of vulnerable apps remains staggeringly high, and open source components continue to present significant risks to businesses. More than 85% of all applications contain at least one vulnerability following the first scan, and more than 13% of applications contain at least one very high severity flaw. In addition, organisations' latest scan results indicate one in three applications were vulnerable to attack through high or very high severity flaws.

An examination of fix rates across 2 trillion lines of code shows companies face extended application risk exposure due to persisting flaws:

* More than 70% of all flaws remained one month after discovery and nearly 55% remained three months after discovery.
* Twenty-five percent of high and very high severity flaws were not addressed within 290 days of discovery.
* Overall, 25% of flaws were fixed within 21 days, while the final 25% remained open well after a year of discovery.

"Security-minded organisations have recognised that embedding security design and testing directly into the continuous software delivery cycle is essential to achieving the DevSecOps principles of balance of speed, flexibility and risk management. Until now, it's been challenging to pinpoint the benefits of this approach, but this latest State of Software Security report provides hard evidence that organisations with more frequent scans are fixing flaws more quickly," said Chris Eng, vice-president of Research, CA Veracode. "These incremental improvements amount over time to a significant advantage in competitiveness in the market and a huge drop in risk associated with vulnerabilities."

Data supports DevSecOps practices

In its third consecutive year documenting DevSecOps practices, the SOSS analysis shows a strong correlation between high rates of security scanning and lower long-term application risks, presenting significant evidence for the efficacy of DevSecOps. CA Veracode's data on flaw persistence shows that organisations with established DevSecOps programmes and practices greatly outperform their peers in how quickly they address flaws.

The most active DevSecOps programs fix flaws more than 11.5 times faster than the typical organisation, due to ongoing security checks during continuous delivery of software builds, largely the result of increased code scanning. The data shows a very strong correlation between how many times a year an organisation scans and how quickly they address their vulnerabilities.

Open source components continue to thwart enterprises

In prior SOSS reports, data has shown that vulnerable open source software components run rampant within most software. The current SOSS report found most applications were still rife with flawed components, though there has been some improvement on the Java front. Whereas last year, about 88% of Java applications had at least one vulnerability in a component, it fell to just over 77% in this report.

As organisations tackle bug-ridden components, they should consider not just the open flaws within libraries and frameworks, but also how they are using those components. By understanding not just the status of the component, but whether or not a vulnerable method is being called, organisations can pinpoint their component risk and prioritise fixes based on the riskiest uses of components.

Regional differences in flaw persistence

While data from US organisations dominate the sample size, this year's report offers insights into differences by region in how quickly vulnerabilities are being addressed. Companies in Asia Pacific (APAC) are the quickest to remediate, closing out 25% of their flaws in about eight days, followed by 22 days for the Americas and 28 days for those in Europe and the Middle East (EMEA).

However, companies in the US and the Americas caught up, closing out 75% of flaws by 413 days, far ahead of those in APAC and EMEA. In fact, it took more than double the average time for EMEA organisations to close out three-quarters of their open vulnerabilities. The data showed EMEA companies lagged behind the average significantly at every milepost of the flaw persistence intervals. Troublingly, 25% of vulnerabilities in organisations in EMEA persisted more than two-and-a-half years after discovery.

Download CA Veracode's State of Software Security here.

CA Veracode

Veracode, CA Technologies' application security business, is a leader in helping organisations secure the software that powers their world. CA Veracode's SaaS platform and integrated solutions help security teams and software developers find and fix security-related defects at all points in the software development life cycle, before they can be exploited by hackers. CA Veracode's complete set of offerings help customers reduce the risk of data breaches, increase the speed of secure software delivery, meet compliance requirements, and cost effectively secure their software assets- whether that's software they make, buy or sell.

CA Veracode serves more than 2,000 customers across a wide range of industries, including nearly one-third of the Fortune 100, three of the top four U.S. commercial banks and more than 20 of Forbes' 100 Most Valuable Brands. Learn more at www.veracode.com, on the Veracode blog, on Twitter and in the CA Veracode Community.

Follow CA Technologies

Twitter
Social Media Page
Press Releases
Blogs

CA Southern Africa

CA Southern Africa enables companies to embark on a frictionless digital transformation journey necessary to seize the opportunities presented by the application economy. Today, software is at the heart of every business, in every industry and we assist our customers - through the use of modern technology, to change the way we live; transact; and communicate across: mobile; cloud; distributed and mainframe environments.

For further information log on to: www.ca.com/za

State of Software Security Report

This is CA Veracode's ninth iteration of the State of Software Security (SOSS) report, a comprehensive review of application security testing data from scans of more than 2 trillion lines of code conducted by CA Veracode's base of 2,000 customers representing the industry's most comprehensive set of application security benchmarks. The report investigated variables such as flaw type, severity, app criticality, rate of scanning impact on fix velocity, and persistence of flaws after discovery. For this iteration, CA Veracode collaborated with data scientists at Cyentia Institute to better visualise and understand vulnerability fix behaviour.

Methodology

CA Veracode's methodology for data analysis uses statistics from a 12-month sample window. The data represents more than 700,000 application assessments submitted for analysis during the 12-month period from April 1, 2017 through March 31, 2018. The data represents large and small companies, commercial software suppliers, open source projects, and software outsourcers. In most analyses, an application was counted only once, even if it was submitted multiple times as vulnerabilities were remediated and new versions uploaded.

The report contains findings about applications that underwent static analysis, dynamic analysis, software composition analysis, and/or manual penetration testing through CA Veracode's cloud-based platform. The report considers data that was provided by CA Veracode customers (application portfolio information such as assurance level, industry, application origin) and information that was calculated or derived in the course of CA Veracode analysis (application size, application compiler and platform, types of vulnerabilities, and CA Veracode Level - predefined security policies which are based on the NIST definitions of assurance levels).

State of Software Security Report

This is CA Veracode's ninth iteration of the State of Software Security (SOSS) report, a comprehensive review of application security testing data from scans of more than 2 trillion lines of code conducted by CA Veracode's base of 2,000 customers representing the industry's most comprehensive set of application security benchmarks. The report investigated variables such as flaw type, severity, app criticality, rate of scanning impact on fix velocity, and persistence of flaws after discovery. For this iteration, CA Veracode collaborated with data scientists at Cyentia Institute to better visualise and understand vulnerability fix behaviour.

Methodology

CA Veracode's methodology for data analysis uses statistics from a 12-month sample window. The data represents more than 700,000 application assessments submitted for analysis during the 12-month period from April 1, 2017 through March 31, 2018. The data represents large and small companies, commercial software suppliers, open source projects, and software outsourcers. In most analyses, an application was counted only once, even if it was submitted multiple times as vulnerabilities were remediated and new versions uploaded.

The report contains findings about applications that underwent static analysis, dynamic analysis, software composition analysis, and/or manual penetration testing through CA Veracode's cloud-based platform. The report considers data that was provided by CA Veracode customers (application portfolio information such as assurance level, industry, application origin) and information that was calculated or derived in the course of CA Veracode analysis (application size, application compiler and platform, types of vulnerabilities, and CA Veracode Level - predefined security policies which are based on the NIST definitions of assurance levels).

Editorial contacts

Deirdre Blain
Blain Communications
(+27) 83 230 5522
blain@iafrica.com
Heidi Ziegelmeier
CA Southern Africa
(+27) 11 417 8594
Heidi.Ziegelmeier@CAafrica.co.za