8 Out of 10 Software Apps Fail Security Test
Desktop and web applications remain a wasteland of bugs and holes that only a hacker could love, according to a report released Wednesday by a company that conducts independent security audits of code.
In fact, eight out of 10 software applications fail to meet a security assessment, according to a State of Software Security report by Veracode. That’s based on an automated analysis of 9,910 applications submitted to Veracode’s online security testing platform in the last 18 months. The applications are submitted by both developers — in the government and commercial sectors — as well as companies and government agencies wanting an assessment of software they plan to purchase.
The company examined commercial and government applications for more than 100 different flaw types, and found that applications created by the government fared worse when it came to cross-site scripting and SQL injection flaws, while commercial applications were more often marred by remote-execution flaws. About 75 percent of government web applications had cross-site scripting issues. Cross-site scripting flaws allow an attacker to inject malicious code into a vulnerable web application to obtain sensitive data from users.
