Ponemon State of Web Application Security Report

Network and host security are provided with hefty budgets, claiming 43% of the IT security pie even though they are only responsible for a small percentage of attacks, 14% by some numbers.

Some other numbers from, “The State of Application Security,” study show that:

• 70% of those who responded don’t believe that their organization allocates enough resources to protecting Web applications
• 34% of vulnerabilities considered urgent are not fixed
• 55% believe that developers are too busy to work on security issues
• 38% believe that to fix a vulnerability in a Web application it would take more than 20 hours
• 43% stated that Web application security is not a corporate priority and developers do not care about this

Ironically, almost three-quarters of those who responded to the survey claim that web security is viewed as a strategic initiative in their organization.

A great deal of the study focused on the developer. Amazingly, most felt that the developer is not responsible for the security of their applications thus allowing the task to fall on the shoulders of those responsible for security in the organization.

Traditionally, IT security focuses on defending the network through host and workstation based methods. Tools like intrusion prevention systems and traditional firewalls are used to defend the network from specific attacks however these safeguards are virtually worthless at protecting attacks launched at the application layer. Knowing that traditional defenses can’t keep them out, attackers look towards holes found in most Web applications as a means of compromising data and resources.

When dissecting the numbers, it looks like fixing vulnerabilities in Web application code is just too much trouble. True, code reviews take a great deal of time to perform and cost a great deal of money. Throw into the mix that organizations may not always have access to the code because of proprietary applications or outsourcing and it is easy to see why so many vulnerabilities go unfixed.

However the difficulty involved does not excuse the organization from having to fix what is broken. Regulations like HIPAA and Sarbanes-Oxley were put in place to protect data in US based organizations. Worldwide compliance with the Payment Card Industry’s Data Security Standards (PCI DSS) is a must for any organization that processes credit card payments. Compliance with any of these regulations cannot be simply swept under the rug because it’s just too hard to do.

Astonishingly, 70% of organizations who have deployed a Web application firewall fix vulnerabilities within one week of discovering them. Used in tandem with secure coding techniques, Web application firewalls can provide logs and analysis of attack patterns to help developers locate vulnerabilities and fix them at a faster rate than if they were simply pouring through lines of code and using automated scanning tools because the Web application firewall produces data related to real attacks. Of course, all the while the WAF is protecting the organization’s data and resources from being compromised because it is stopping attackers at their most common point of entry, the Web application itself.

Related Articles:

Microsoft confirms critical IE bug, works on fix
CWE/SANS Top 25
What is Cross-Site Scripting (XSS)?