[ad_1]
Just as machines age and become unreliable and people develop health problems with age, software seems to become more likely to have security flaws as it grows in use.
According to a new report from security testing firm Veracode, 32% of applications were found to have flaws in their initial scan, but after five years of operation, nearly 70% had at least one security flaw. is included.
The report suggests that teams should prioritize remediation early in the software development lifecycle to minimize the risk caused by defect buildup.
Chris Eng, chief research officer at Veracode, said: Apart from technical access controls, secure coding practices are becoming increasingly important for cybersecurity in 2023 and beyond. ”
After the initial scan, the app immediately enters a stable “honeymoon period”, with nearly 80% free of any new defects for the first 1.5 years. However, after this point the number of new defects introduced starts to rise again, to about 35% after 5 years. By the time a piece of software reaches his ten-year point, there is a 90% chance that it contains at least one defect.
Veracode’s research team also examined 30,000 open source repositories published on GitHub. Interestingly, 10% of the repositories hadn’t made a commit (source code change) for about 6 years.
“By using a software composition analysis (SCA) solution that leverages multiple defect sources beyond the National Vulnerability Database, we can proactively alert teams when vulnerabilities are revealed and hopefully exploitation begins. In addition to considering ways to reduce reliance on third parties, it is also a good idea to set organizational policies for vulnerability detection and management. Recommended.”
The report recommends that security teams and developers address any technical or security debt as early and expeditiously as possible. You should also prioritize automation and developer security training to understand the vulnerabilities most likely to be introduced and techniques to avoid introducing flaws entirely.
A full report is available from the Veracode site.
Photo credit: andriano.cz/Shutterstock
[ad_2]
Source link
