Menu
Study: Largest vendors account for fewer software flaws

Study: Largest vendors account for fewer software flaws

Though it might not seem that way, the top 10 most vulnerable software vendors -- and, yes, that includes Microsoft Corp. -- are contributing a smaller percentage of all vulnerability disclosures per year compared to five years ago.

That's according to an analysis by Gunter Ollmann, director of security strategies at IBM's Internet Security Systems X-Force team.

Ollmann, who crunched vulnerability data gathered by X-Force between 2002 and 2006, said the overall percentage of security flaws disclosed by the most vulnerable software vendors dropped from 20.2 percent in 2002 to 14.6 percent during that period.

Much of that decrease is likely the result of improved quality assurance and testing processes by the most vulnerable software vendors, Ollmann said. Most of their software packages have been through multiple versions and have been combed thoroughly for vulnerabilities by security researchers, Ollmann said.

According to Ollmann, the most vulnerable vendors typically have also been the biggest software vendors and those with the largest installed bases. Traditionally, security researchers and hackers have gone after vendors with the biggest installed bases because that is where they can have the biggest impact.

As larger vendors begin to do a better job of locking down their software, hackers and software researchers have begun focusing their attention on newer vendors and their applications, which has resulted in an overall increase in the number of vulnerabilities being reported, Ollmann said.

In the past five years, the list of the most vulnerable vendors has consistently included Microsoft, Cisco Systems Inc., IBM Corp., Sun Microsystems Inc. and the Linux Kernel Organization, Ollmann said. Others on the list for 2006 were Oracle Corp., Apple Inc, Mozilla and Adobe Systems Inc.

Together, these vendors accounted for 964 vulnerabilities in 2006, or roughly 14 percent of the total disclosed by all vendors. The remaining 85 percent or more were accounted for by smaller vendors. For instance, nearly 1,000 vulnerabilities were reported by relatively small vendors of PHP applications, he said.

Ollmann conceded that the vulnerabilities reported by the top 10 are likely to have affected a far larger number of people than a majority of the flaws reported by smaller vendors. At the same time, it is also true that the larger vendors by and large have been doing a better job in fixing reported flaws, he said.

Out of the top 10 vendors, only 14 percent of the publicly reported flaws remained unpatched in 2006, while 65 percent of all other publicly reported flaws remain unpatched.

Larger vendors are also likely to have better mechanisms in place for detecting flaws and alerting customers than the smaller ones, he added.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Brand Post

Featured

Slideshows

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards

Hundreds of leaders from the New Zealand IT industry gathered at the Hilton in Auckland on 17 November to celebrate the finest female talent in the Kiwi channel and recognise the winners of the Reseller News Women in ICT Awards (WIICTA) 2020.

The Kiwi channel gathers for the 2020 Reseller News Women in ICT Awards
Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards

Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards

The leading female front runners of the New Zealand ICT industry joined together for the annual Reseller News Women in ICT Awards event at the Hilton in Auckland, during which hundreds of guests celebrated 13 outstanding individuals who won awards, chosen from more than 50 finalists representing over 30 organisations.

Leading female front runners honoured at the 2020 Reseller News Women in ICT Awards
Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners

More than 500 channel leaders gathered in Auckland on 21 October at the ​Reseller News Innovation Awards ​2020 to celebrate the achievements of the New Zealand technology industry's top partners, start-ups, vendors, distributors and individuals.

Channel gathers to celebrate the Reseller News Innovation Awards 2020 winners
Show Comments