Retail's State of Software Security and How It Can Improve from Here
April 22, 2021

Chris Wysopal
Veracode

Retail may never be the same as it was pre-COVID and the pace of digital transformation keeps pushing faster. Worldwide online retail sales grew by more than 27 percent in 2020, and retailers "will likely ramp up their digital offerings as consumer shopping habits continue to lean in favor of ecommerce. An estimated 40% of consumers say they plan to shop in-store either the same amount or less after being vaccinated."

Because of the major uptick in volume in ecommerce, retailers' digital presence needs to be responsive and secure. Web applications need to meet customer demands for speed and a simple interface, but with 43% of all breaches occurring as a result of a vulnerable application layer, the security of these applications is critical.

Application security insights will be valuable and relevant for retailers on account of the growth of e-commerce and the revenue it is driving.

Veracode's recent State of Software Security report (SoSS) highlighted the frequency of vulnerabilities in applications across different industry verticals, including the retail and hospitality sector.


The report found that:

■ 26% of retail applications have high-severity security flaws

■ 76% of retail applications have flaws

■ 74% of total retail flaws are being fixed

To understand the context of this data, it's helpful to draw a comparison between how well retail and other industries secure applications and protect customers. The frequency of flawed retail applications is high, with more than three out of every four (76% to be exact) applications containing at least one flaw. Fortunately, regardless of this high volume of vulnerabilities, the retail industry's rate of fixing at 74% is second only to the financial services industry at 75%, and has a better rate than healthcare, manufacturing, technology and government verticals.

Retail, in addition to success in fix rate, has the best flaw-remediation speed, with the average application taking 125 days to fix half of its known defects. This means although the retail and hospitality sector begins with more flaws than some other industries, developers are relatively faster to recognize them, buckle down, and fix the flaws in an effort to improve the application's security and protect customer data.

In looking at this data, it's clear to see the promise of the retail industry's overall effectiveness in vulnerability detection and fixing, but it begs the question: What does all of this mean for retail amidst the ongoing COVID-19 pandemic? We have to understand there has been a new normal created for business and that normal is centered around e-commerce, which heavily drives up traffic across various applications.

An important figure to note from the SoSS report is that 55% of severe retail and hospitality flaws can be grouped into information leakage. If information leakage is exploited, it will deteriorate the consumer to business relationship. In addition, an exploitation of this type would heavily damage a company's brand and reputation.

Simply put, as online traffic, users, and applications increase, retail applications security must improve alongside it. Retail organizations must take on the responsibility of integrating security throughout the software development lifecycle, running security checks on their applications frequently, and using multiple types of scans, through both static and dynamic analysis, to identify defects. Following information leakage, the next top three flaw types are CRLF injection, cryptographic issues, and code quality. These flaws can be mitigated by implementing some sort of education program to build stronger, more secure code for retail applications.

Ultimately, every application will contain security defects, but to combat the unavoidable, developers and security teams should always strive to improve their ability to find and fix security issues with speed.

One way to achieve the goal of faster remediation speed and applications with fewer flaws involves educating the developers who build and deploy the applications on avoiding common security flaws and writing secure base code. This foundation will, in turn, make it much easier to fix flaws over time and increase remediation speed. From there, AppSec programs in retail organizations will be better prepared to handle faster release cycles without slowing down developers.

Chris Wysopal is Co-Founder and CTO of Veracode
Share this

Industry News

May 06, 2021

Splunk announced the new Splunk Observability Cloud, the full-stack, analytics-powered and enterprise-grade Observability solution.

May 06, 2021

Gluware unveiled its DevOps for NetOps framework featuring Gluware Lab, its integrated development environment (IDE).

May 06, 2021

Ambassador Labs announced the new Ambassador Developer Control Plane (DCP), whichgives developers the ability to manage the entire modern software development lifecycle for Kubernetes environments using tools and processes that are familiar to them.

May 06, 2021

Code Dx and Secure Code Warrior have teamed up to launch Project Better Code, an initiative to tackle a major challenge facing innovative organizations today – pushing the pace of software development without compromising software security.

May 06, 2021

Pegasystems announced the latest evolution of its Pega Infinity software suite to help speed and simplify digital transformation (DT) initiatives, Pega Infinity version 8.6.

May 06, 2021

Accurics announced that its open source project Terrascan, which enables teams to detect compliance and security violations across Infrastructure as Code (IaC), now integrates with the Argo Project.

May 05, 2021

Amazon Web Services announced the general availability of Amazon DevOps Guru, a fully managed operations service that uses machine learning to make it easier for developers to improve application availability by automatically detecting operational issues and recommending specific actions for remediation.

May 05, 2021

SmartBear has added API testing support for the popular, open source event streaming platform, Apache Kafka.

May 05, 2021

Red Hat unveiled its Developer Sandbox for Red Hat OpenShift, an OpenShift-based development environment designed to enable organizations to accelerate the path from code to production for Kubernetes-based applications.

May 05, 2021

DevOps Institute announced the lineup for SKILup Days in the second quarter of 2021.

May 05, 2021

Idera announced the acquisition of Xblend Software.

May 04, 2021

ThoughtSpot announced the launch of ThoughtSpot Everywhere.

May 04, 2021

Perforce Software announced the availability of virtual devices (Android emulators and iOS simulators) as part of the comprehensive device lab within Perfecto’s Intelligent Test Automation platform.

May 04, 2021

LogiGear announced the newest release of its flagship TestArchitect™ Enterprise product, TestArchitect Enterprise 9.0.

May 04, 2021

Rafay Systems announced new enhancements to its flagship Kubernetes Management Cloud (KMC).