Nearly half of organizations knowingly push vulnerable software: Study

Nearly half of organizations regularly and knowingly ship vulnerable code despite using application security tools, according to Veracode-ESG’s Modern Application Development Security research. Among the top reasons cited for pushing vulnerable code were pressure to meet release deadlines (54%) and finding vulnerabilities too late in the software development lifecycle (45%). Respondents said that the lack of developer knowledge to mitigate issues and lack of integration between AppSec tools were two of the top challenges they face with implementing DevSecOps. However, nearly nine of ten companies said they would invest further in AppSec this year.

The study sheds light on how AppSec practices and tools are intersecting with emerging development methods and creating new priorities such as reducing open source risk and API testing.

“The software development landscape today is evolving at light speed. Microservices-driven architecture, containers, and cloud-native applications are shifting the dynamics of how developers build, test, and deploy code. Without better testing, integration, and regular developer training, organizations will put themselves at jeopardy for a significant breach,” said Chris Wysopal, Chief Technology Officer at Veracode. “We’re helping companies shift left in the development cycle by instrumenting CI pipelines and scanning earlier and more frequently to mitigate risk and lower false positives. With offerings like Veracode Security Labs, we’re making sure that developers get more than a once per year crash course on secure development. Instead, they can access real-world scenarios and tests to ensure their secure coding skills are constantly evolving and expanding. Any company investing in AppSec must have a solid developer training program – otherwise they’ll find themselves at risk.”

Among the key findings of the report:

• 60% of organizations report having production applications exploited by OWASP Top 10 vulnerabilities in the past 12 months. Similarly, the recent Veracode State of Software Security: Open Source Edition found that seven in 10 applications have a security flaw in an open source library on initial scan.
• Developers’ lack of knowledge on how to mitigate issues is the biggest AppSec challenge – 53% of organizations only provide security training for developers once a year or less. Veracode data shows that the top 1% of applications with the highest scan frequency carry about five times less security debt, or unresolved flaws, than the least frequently scanned applications, which means frequent scanning helps developers find and fix flaws to significantly lower their organization’s risk.
• 43% cited DevOps integration as the most important aspect to improving their AppSec program.
• 84% report challenges due to too many AppSec tools, making DevOps integration difficult. 43% of companies report that they have between 11-20 AppSec tools in use, while 22% said they use between 21-50.

According to ESG, the most effective AppSec programs report the following as some of the critical components of their program:

• Application security is highly integrated into the CI/CD toolchain
• Ongoing, customized AppSec training for developers
• Tracking continuous improvement metrics within individual development teams
• AppSec best practices are being shared by development managers
• Using analytics to track progress of AppSec programs and to provide data to management