Menu
The government is falling behind on application security

The government is falling behind on application security

Three out of four government applications fail the OWASP Top 10 and the government is slacking off on fixing flaws, Veracode found

Top 10 application vulnerability categories by industry vertical

Top 10 application vulnerability categories by industry vertical

Government organizations are struggling when it comes to securing the computer software they use, which could partially explain the large data breaches reported in that sector over the past several years.

Three out of four applications used by government organizations are not compliant with one of the primary software security policies and most of the flaws found in them never get fixed, according to a report released Tuesday by U.S.-based application security firm Veracode.

The report is based on an analysis of more than 200,000 applications over the past 18 months that are used by organizations in various industries. The tests were performed using Veracode's cloud-based application security testing platform that uses static analysis, dynamic analysis and manual penetration testing techniques.

The company found that only 24 percent of applications submitted for review by government customers were compliant with the OWASP Top 10, a list of the top 10 most common types of vulnerabilities for Web applications, complete with explanations of the risks they pose, code examples and guidance on how to avoid them. The OWASP Top 10 is referenced by many other standards, including the Payment Card Industry Data Security Standard (PCI DSS).

By contrast, applications from the financial services sector had an OWASP Top 10 compliance rate of 42 percent, those from the manufacturing sector, 35 percent, and those used by technology companies, 32 percent. Applications used in the health care and the retail and hospitality sectors had a compliance rate of 31 and 30 percent, respectively -- both of these sectors having been plagued by large data breaches in recent years.

There are multiple reasons why the government is scoring badly on application security, according to Chris Wysopal, the chief technology officer of Veracode. These include the government's use of old scripting and programming languages, its failure to self regulate and its failure to impose security requirements on its software suppliers.

The government sector still uses a lot of legacy code written in languages like ColdFusion or Classic ASP that were popular in the 1990s, Wysopal said. Other industries have moved away from those and are now largely focusing on languages like .NET or Java that are faster, and where it's harder to make certain errors, he said.

In other industry sectors like financial services there's strong competition between companies, which drives them to modernize their systems and applications, but that competitive pressure doesn't exist inside the government, Wysopal said.

Using older programming languages wouldn't be such a big problem if the government would routinely fix the identified flaws. Sadly, Veracode's data shows that the government's remediation rate for flaws found in its applications is only 27 percent.

The company saw a high level of legacy code use in the manufacturing sector as well, but by comparison, those companies patched 80 percent of their application flaws. That vulnerability remediation rate was even higher than that of financial services companies, which are a primary target for hackers and are typically more diligent.

Another important aspect that contributes to the problem is that the government's approach to security is very compliance oriented instead of being based on assessing risk.

Government organizations wait for orders from the Government Accountability Office or are implementing standards from the National Institute of Standards and Technology, and this means that their security is moving very slowly because those regulations take many years to change, Wysopal said.

Meanwhile, the field of application security has rapidly grown in prominence over the past five years with the rise of Web and mobile applications. These applications allow organizations to provide valuable new services, but at the same time add a lot of risks and need to be covered by their security programs, he said.

There's also a lack of sanctions for government organizations, according to Wysopal. By comparison, healthcare or financial organizations have to follow strict data protection rules and risk serious fines if their sensitive customer information is compromised.

"Who's getting fined for the recent breach at the Office of Personnel Management that exposed information on millions of current and former federal employees?" Wysopal said. "Nobody, because the government doesn't really hold itself accountable like it holds others."

Another aspect that plays into the poor state of application security inside government organizations is that most of the applications they use are either purchased from third-parties or are developed by outsourcing firms. Veracode's data shows that less than one in three commercial applications that were purchased by organizations from third-party software suppliers were compliant with the OWASP Top 10 when first tested.

Outsourcing software development is not a problem per se, as financial services or manufacturing companies rely heavily on this practice too, Wysopal said. However, those companies have better application security because they have requirements in place for their software suppliers, such as mandatory third-party security testing or compliance with certain security standards. "We don't see that inside the government," he said.

This should serve as a wake-up call to everybody, Wysopal said. Organizations should look at their software supply chains, put security requirements in their contracts and test the applications they're getting so they can hold vendors accountable, he said.

When it comes to vulnerability remediation Veracode found that many companies don't fix some of the flaws found in their applications because they lack people with application security expertise. Because of that, the vulnerability reports keep piling up and never get fixed.

Companies have understood that they need to do more application security testing, but they're having trouble solving the problems they find, Wysopal said. Companies should definitely invest in application security training for their developers, but in the meantime they can also look externally to security companies that can provide assistance on fixing application flaws as a service, he said.


Follow Us

Join the newsletter!

Or

Sign up to gain exclusive access to email subscriptions, event invitations, competitions, giveaways, and much more.

Membership is free, and your security and privacy remain protected. View our privacy policy before signing up.

Error: Please check your email address.

Tags Veracodedata protectionCompliance monitoringExploits / vulnerabilities

Featured

Slideshows

The making of an MSSP: a blueprint for growth in NZ

The making of an MSSP: a blueprint for growth in NZ

Partners are actively building out security practices and services to match, yet remain challenged by a lack of guidance in the market. This exclusive Reseller News Roundtable - in association with Sophos - assessed the making of an MSSP, outlining the blueprint for growth and how partners can differentiate in New Zealand.

The making of an MSSP: a blueprint for growth in NZ
Reseller News Platinum Club celebrates leading partners in 2018

Reseller News Platinum Club celebrates leading partners in 2018

The leading players of the New Zealand channel came together to celebrate a year of achievement at the inaugural Reseller News Platinum Club lunch in Auckland. Following the Reseller News Innovation Awards, Platinum Club provides a platform to showcase the top performing partners and start-ups of the past 12 months, with more than ​​50 organisations in the spotlight.​​​

Reseller News Platinum Club celebrates leading partners in 2018
Meet the top performing HP partners in NZ

Meet the top performing HP partners in NZ

HP has honoured its leading partners in New Zealand during 2018, following 12 months of growth through the local channel. Unveiled during the fourth running of the ceremony in Auckland, the awards recognise and celebrate excellence, growth, consistency and engagement of standout Kiwi partners.

Meet the top performing HP partners in NZ
Show Comments