CA Veracode, part of CA Technologies, have released the latest State of Software Security (SOSS) report. The study includes promising signs that DevSecOps is facilitating better security and efficiency, and provides the industry with the company's first look at flaw persistence analysis, which measures the longevity of flaws after first discovery. Businesses in the UK outperformed most regions in finding and fixing flaws in their software, but most European nations analysed fall well behind in remediation.
The State of Software Security is Improving
In every industry, organisations are dealing with a massive volume of open flaws to address, and they are showing improvement in taking action against what they find. According to the report, 69 percent of flaws discovered were closed through remediation or mitigation, an increase of nearly 12 percent since the previous report. This shows organisations are gaining prowess in closing newly discovered vulnerabilities, which hackers often seek to exploit.
Despite this progress, the new SOSS report also shows that the number of vulnerable apps remains staggeringly high, and open source components continue to present significant risks to businesses. More than 85 percent of all applications contain at least one vulnerability following the first scan, and more than 13 percent of applications contain at least one very high severity flaw. In addition, organisations' latest scan results indicate that one in three applications were vulnerable to attack through high or very high severity flaws.
An examination of fix rates across 2 trillion lines of code shows that companies face extended application risk exposure due to persisting flaws:
* More than 70 percent of all flaws remained one month after discovery and nearly 55 percent remained three months after discovery
* 25 percent of high and very high severity flaws were not addressed within 290 days of discovery
* Overall, 25 percent of flaws were fixed within 21 days, while the final 25 percent remained open, well after a year of discovery
"Security-minded organisations have recognised that embedding security design and testing directly into the continuous software delivery cycle is essential to achieving the DevSecOps principles of balance of speed, flexibility and risk management. Until now, it's been challenging to pinpoint the benefits of this approach, but this latest State of Software Security report provides hard evidence that organisations with...