Retail's State of Software Security and How It Can Improve from Here
April 22, 2021

Chris Wysopal

Retail may never be the same as it was pre-COVID and the pace of digital transformation keeps pushing faster. Worldwide online retail sales grew by more than 27 percent in 2020, and retailers "will likely ramp up their digital offerings as consumer shopping habits continue to lean in favor of ecommerce. An estimated 40% of consumers say they plan to shop in-store either the same amount or less after being vaccinated."

Because of the major uptick in volume in ecommerce, retailers' digital presence needs to be responsive and secure. Web applications need to meet customer demands for speed and a simple interface, but with 43% of all breaches occurring as a result of a vulnerable application layer, the security of these applications is critical.

Application security insights will be valuable and relevant for retailers on account of the growth of e-commerce and the revenue it is driving.

Veracode's recent State of Software Security report (SoSS) highlighted the frequency of vulnerabilities in applications across different industry verticals, including the retail and hospitality sector.

The report found that:

■ 26% of retail applications have high-severity security flaws

■ 76% of retail applications have flaws

■ 74% of total retail flaws are being fixed

To understand the context of this data, it's helpful to draw a comparison between how well retail and other industries secure applications and protect customers. The frequency of flawed retail applications is high, with more than three out of every four (76% to be exact) applications containing at least one flaw. Fortunately, regardless of this high volume of vulnerabilities, the retail industry's rate of fixing at 74% is second only to the financial services industry at 75%, and has a better rate than healthcare, manufacturing, technology and government verticals.

Retail, in addition to success in fix rate, has the best flaw-remediation speed, with the average application taking 125 days to fix half of its known defects. This means although the retail and hospitality sector begins with more flaws than some other industries, developers are relatively faster to recognize them, buckle down, and fix the flaws in an effort to improve the application's security and protect customer data.

In looking at this data, it's clear to see the promise of the retail industry's overall effectiveness in vulnerability detection and fixing, but it begs the question: What does all of this mean for retail amidst the ongoing COVID-19 pandemic? We have to understand there has been a new normal created for business and that normal is centered around e-commerce, which heavily drives up traffic across various applications.

An important figure to note from the SoSS report is that 55% of severe retail and hospitality flaws can be grouped into information leakage. If information leakage is exploited, it will deteriorate the consumer to business relationship. In addition, an exploitation of this type would heavily damage a company's brand and reputation.

Simply put, as online traffic, users, and applications increase, retail applications security must improve alongside it. Retail organizations must take on the responsibility of integrating security throughout the software development lifecycle, running security checks on their applications frequently, and using multiple types of scans, through both static and dynamic analysis, to identify defects. Following information leakage, the next top three flaw types are CRLF injection, cryptographic issues, and code quality. These flaws can be mitigated by implementing some sort of education program to build stronger, more secure code for retail applications.

Ultimately, every application will contain security defects, but to combat the unavoidable, developers and security teams should always strive to improve their ability to find and fix security issues with speed.

One way to achieve the goal of faster remediation speed and applications with fewer flaws involves educating the developers who build and deploy the applications on avoiding common security flaws and writing secure base code. This foundation will, in turn, make it much easier to fix flaws over time and increase remediation speed. From there, AppSec programs in retail organizations will be better prepared to handle faster release cycles without slowing down developers.

Chris Wysopal is Co-Founder and CTO of Veracode
Share this

Industry News

September 16, 2021

SnapLogic released the latest version of its new SnapLogic Flows solution.

September 16, 2021

Postman launched a new version of its API Management platform.

September 16, 2021

Progress announced its R3 2021 release of Progress Telerik and Progress Kendo UI.

September 15, 2021

Progress announced the availability of Progress Sitefinity DX 14.0.

September 15, 2021

Launchable, the intelligence platform layer for all software testing, announced their latest addition to the platform, Flaky Tests Insights (beta).

September 15, 2021

Rezilion announced $30 million in Series A funding led by Guggenheim Investments.

September 14, 2021

Oracle announced the availability of Java 17, the latest version of the Java programming language and development platform.

September 14, 2021

Leostream announced the Leostream RESTful API.

September 14, 2021

Evinced announced the launch of a complete portfolio of products to enable enterprise developers to weave accessibility into their iOS and Android mobile app development process.

September 13, 2021

JFrog announced the acquisition of Upswift, the creators of connected device management software for developers.

September 13, 2021

MajorKey Technologies is an official Atlassian Specialized Partner in Cloud.

September 13, 2021

Copado raised $140 million in Series C financing, bringing the total funds invested in the company to $257 million.

September 09, 2021 is partnering with Amazon EKS Anywhere to provide Kubernetes-native API gateway and service mesh capabilities to their new Amazon EKS Anywhere service.

September 09, 2021

JFrog announced an agreement with SB C&S Corp. to deliver its scalable DevOps Platform to help customers in Japan release software in a fast and secure manner from development all the way to the edge.

September 09, 2021

Mirantis announced the availability of Mirantis OpenStack 21.4 that includes a number of important enhancements which enable enterprises to support a broader range of deployment options, extend private clouds over public networks and provide long-term support for OpenStack Victoria.