DevSecOps Enables Companies to Address Flaws 11x Faster
November 29, 2018

Pete Goldin
DEVOPSdigest

Organizations with established DevSecOps programs and practices greatly outperform their peers in how quickly they address flaws. The most active DevSecOps programs fix flaws more than 11.5 times faster than the typical organization, due to ongoing security checks during continuous delivery of software builds, largely the result of increased code scanning, according the latest State of Software Security (SOSS) report from CA Veracode, part of CA Technologies.

The SOSS analysis shows a strong correlation between high rates of security scanning and lower long-term application risks, supporting the case for DevSecOps. The data also shows a very strong correlation between how many times per year an organization scans and how quickly they address their vulnerabilities.

The State of Software Security is Improving

According to the report, 69 percent of flaws discovered were closed through remediation or mitigation, an increase of nearly 12 percent since the previous report. This shows organizations are gaining prowess in closing newly discovered vulnerabilities, which hackers often seek to exploit.

Despite this progress, the new SOSS report also shows that the number of vulnerable apps remains staggeringly high, and open source components continue to present significant risks to businesses. More than 85 percent of all applications contain at least one vulnerability following the first scan, and more than 13 percent of applications contain at least one very high severity flaw. In addition, organizations’ latest scan results indicate that one in three applications were vulnerable to attack through high or very high severity flaws.

An examination of fix rates across 2 trillion lines of code shows that companies face extended application risk exposure due to persisting flaws:

■ More than 70 percent of all flaws remained one month after discovery and nearly 55 percent remained three months after discovery

■ 25 percent of high and very high severity flaws were not addressed within 290 days of discovery

■ Overall, 25 percent of flaws were fixed within 21 days, while the final 25 percent remained open, well after a year of discovery

“Security-minded organizations have recognized that embedding security design and testing directly into the continuous software delivery cycle is essential to achieving the DevSecOps principles of balance of speed, flexibility and risk management. Until now, it’s been challenging to pinpoint the benefits of this approach, but this latest State of Software Security report provides hard evidence that organizations with more frequent scans are fixing flaws more quickly,” said Chris Eng, VP of Research, CA Veracode. “These incremental improvements amount over time to a significant advantage in competitiveness in the market and a huge drop in risk associated with vulnerabilities.

Open Source Components Still Risky

In prior SOSS reports, data has shown that vulnerable open source software components run rampant within most software. The current SOSS report found that most applications were still rife with flawed components, though there has been some improvement on the Java front. Whereas last year about 88 percent of Java applications had at least one vulnerability in a component, it fell to just over 77 percent in this report.

As organizations tackle bug-ridden components, they should consider not just the open flaws within libraries and frameworks, but also how they are using those components. By understanding not just the status of the component, but whether or not a vulnerable method is being called, organizations can pinpoint their component risk and prioritize fixes based on the riskiest uses of components.

Regional Differences in Flaw Persistence

Companies in Asia Pacific (APAC) are the quickest to remediate, closing out 25 percent of their flaws in about 8 days, followed by 22 days for the Americas and 28 days for those in Europe and the Middle East (EMEA).

However, companies in the US and the Americas caught up, closing out 75 percent of flaws by 413 days, far ahead of those in APAC and EMEA. In fact, it took more than double the average time for EMEA organizations to close out three-quarters of their open vulnerabilities. The data showed EMEA companies lagged behind the average significantly at every milepost of the flaw persistence intervals. Troublingly, 25 percent of vulnerabilities in organizations in EMEA persisted more than two-and-a-half years after discovery.

Methodology: CA Veracode’s methodology for data analysis uses statistics from a 12-month sample window. The data represents more than 700,000 application assessments submitted for analysis during the 12-month period from April 1, 2017 through March 31, 2018. The data represents large and small companies, commercial software suppliers, open source projects, and software outsourcers. In most analyses, an application was counted only once, even if it was submitted multiple times as vulnerabilities were remediated and new versions uploaded.

Pete Goldin is Editor and Publisher of DEVOPSdigest
Share this

Industry News

March 21, 2023

OpenText launched the latest version of ValueEdge -- an innovative modular, cloud-based DevOps and value stream management (VSM) platform.

March 21, 2023

Oracle announced the availability of Java 20, the latest version of the programming language and development platform.

March 21, 2023

Rafay Systems introduced Environment Manager, a solution that empowers enterprise platform teams to improve the developer experience by delivering self-service capabilities for provisioning full-stack environments.

March 20, 2023

To meet the growing demand for Oracle Container Engine for Kubernetes (OKE) with global organizations, Oracle Cloud Infrastructure (OCI) is introducing new capabilities that can boost the reliability and efficiency of large-scale Kubernetes environments while simplifying operations and reducing costs.

March 20, 2023

Perforce Software joined the Amazon Web Services (AWS) Independent Software Vendor (ISV) Accelerate Program and listed its free Enhanced Studio Pack (ESP) in AWS Marketplace.

March 20, 2023

Aembit, an identity platform that lets DevOps and Security teams discover, manage, enforce, and audit access between federated workloads, announced its official launch alongside $16.6M in seed financing from cybersecurity specialist investors Ballistic Ventures and Ten Eleven Ventures.

March 16, 2023

Hyland released Alfresco Content Services 7.0 – a cloud-native content services platform, optimized for content model flexibility and performance at scale.

March 16, 2023

CAST AI has announced the closing of a $20M investment round.

March 15, 2023

Check Point® Software Technologies introduced Infinity Global Services, an all-encompassing security solution that will empower organizations of all sizes to fortify their systems, from cloud to network to endpoint.

March 15, 2023

OpsCruise's Kubernetes and Cloud Service observability platform is certified to run on the Red Hat OpenShift Kubernetes platform.

March 14, 2023

DataOps.live released an update to the DataOps.live platform, delivering productivity for data teams.

March 14, 2023

CoreStack and Zensar announced a strategic global partnership. CoreStack will provide its AI-powered NextGen cloud governance and FinOps capabilities, complementing Zensar’s composable cloud operations offering.

March 14, 2023

Delinea introduced the Delinea Platform, a cloud-native foundation for Delinea's PAM solutions that empowers end-to-end visibility, dynamic privilege controls, and adaptive security.

March 13, 2023

Sysdig announced a new foundation that will serve as the long-term custodian of the Wireshark open source project.

March 13, 2023

Talend announced the latest update to Talend Data Fabric, its end-to-end platform for data discovery, transformation, governance, and sharing.