Two thirds of organisations have experienced a security breach in the past 12 months

(04/05/2009)

According to a recent Veracode survey conducted by Forrester Consulting, enterprises are struggling to protect their organisations from the costly and growing threat of application security breaches. The study interviewed development, security and risk professionals across the UK and US, and confirmed that risk associated with insecure software is a very real concern and a top priority for management and developers alike.

The survey found that more than 62% of organisations have experienced a security breach in the past 12 months due to exploitation of vulnerabilities in their critical software applications. The study also found that while companies feel they know the make-up and business criticality of their mixed application portfolios, there is little confidence in the security quality of their applications.

“Companies are not doing enough to ensure the security of open source code, outsourced code and commercial applications,” according to the study by Forrester Consulting.

Other key findings:

· Exploitation of vulnerabilities in software is a major cause of data breaches. 62% of companies responded that they have experienced security breaches which exploited vulnerabilities in software in the last 12 months

· Security as part of the software development process is not widely practised. Only 34% of companies have a comprehensive SDLC (software development life cycle) process which integrates application security.

· More than half of companies (57%) use outsourcing regularly for business critical. Yet only one third of companies require rigorous security testing before accepting and implementing code from outsourcers

· Only 13% of companies know the security quality of business critical applications. Very few respondents know the security quality of all their business applications which they deem critical to the enterprise.

· Considering that 50% of companies are using COTS (custom-off-the-shelf software) or Outsourced code to handle sensitive data (financial information, PII, health info etc). this indicates why the risk and resultant fallout from breaches is so great.

· Enterprises are increasing scrutiny on ISVs (independent software vendors) and outsourcers for delivering secure code. 60% of respondents stated they are actively incorporating (or have already adopted) third party security assessments as part of software procurement processes for COTS or outsourced code.

· Most enterprises lack formal secure development training programmes. 57% of organisations don’t have systematic training programmes addressing application security training for their developers.

· Security spending is not immune to economic conditions. 64% of respondents stated that while application security is important to them, they are struggling to meet the challenge on existing budgets.

The results of the survey were consistent between UK and US organisations. The UK uses less open source and outsourced applications extensively for business critical functions and has a lower of ratio of security personnel to developers, but the results in terms of breaches were in essence the same. More detailed specifics on this are available on request.

“The same economic forces driving enterprises to use third party applications are also increasing the risk of insecure software” says Matt Moynahan, CEO of Veracode. “Given the prolific use of third-parties to build business critical applications, global enterprises need a single flexible and cost-effective solution to seamlessly test the security across their entire application portfolio regardless of whether it was built internally or externally.”

Related topics:  Application and software security   Hacking and intrusion prevention 

Print version | Email to a friend | Related articles

Data breaches: Trends, costs and best practices gives you all the latest information on securing personal and corporate data, key recommendations for immediate action to improve data security, and how to respond to data breaches.

Other Security news and resources