Backslash Security introduced its Fix Simulation and AI-powered Attack Path Remediation capabilities.
Security is taking a toll on productivity, according to the Software Supply Chain State of the Union report from JFrog.
48% of survey respondents said it typically takes a week or longer to get approval to use a new package/library, extending time to market for new apps and software updates.
Additionally, approximately 25% of security teams' time is spent remediating vulnerabilities, even when those vulnerabilities may be overrated or even non-exploitable given their current context.
Source: JFrog
More key findings of the report include:
Not all CVEs are what they seem
Traditional CVSS ratings look purely at the severity of the exploit as opposed to the likelihood it will be exploited, which requires context to make an effective assessment. The JFrog Security Research team downgraded the severity of 85% of Critical CVEs and 73% of High CVEs on average after analyzing 212 different high-profile CVEs discovered in 2023. Additionally, JFrog found that 74% of the reported common CVEs with High and Critical CVSS scores on the top 100 Docker Hub community images weren't exploitable.
Denial of Service (DoS) attacks reign
Of the 212 high-profile CVEs analyzed for the report, 37.4% of them held the potential for a DoS attack vs. 19% with the potential to perform Remote Code Execution (RCE). This is good news for security organizations in the sense that RCE has a far more detrimental impact vs. DoS attacks due to their ability to offer full access to backend systems.
Applying security checks is inconsistent across SLDC
The industry seems to be split pretty evenly down the middle when it comes to deciding where to apply application security testing across the software development lifecycle (SDLC), underscoring the importance of shifting left and right simultaneously.
42% of developers claim it's best to perform security scans during code writing while 41% say it's best to perform scans on new software packages before bringing them into your organization from an Open-Source Software (OSS) repository.
Security tool sprawl continues
Nearly half of IT professionals (47%) say they use between four and nine application security solutions. However, a third of survey respondents and security professionals (33%) say they're using 10 or more application security solutions. This supports a market-wide trend of needing security tooling consolidation with a movement away from point solutions.
Disproportionate use of AI/ML tools for security
While 90% of survey respondents indicate their organization currently uses AI/ML-powered tools in some capacity to assist in security scanning and remediation efforts, only one in three professionals (32%) claim their organization uses AI/ML-powered tools to write code, indicating the majority are still wary of the potential vulnerabilities Gen-AI developed code can introduce to enterprise software.
"Vulnerabilities are growing in number year over year, but that does not necessarily mean they are growing in severity. It's clear that IT teams are willing to invest in new tools to bolster their security, but knowing where to put those tools, use their team's time, and streamline processes is critical to keeping their SDLC secure," said Shachar Menashe, Sr. Director, JFrog Security Research.
Methodology: The Software Supply Chain State of the Union report combines JFrog Artifactory developer usage data amongst 7K+ organizations, original CVE analysis by the JFrog Security Research team, and commissioned third-party survey data of 1,200 technology professionals worldwide to provide context into the broad, rapidly evolving software supply chain landscape.
Industry News
Check Point® Software Technologies Ltd. announced the appointment of Nadav Zafrir as Check Point Chief Executive Officer.
Sonatype announced that Sonatype SBOM Manager, its Enterprise-Class Software Bill of Materials (SBOM) solution, and its artifact repository manager, Nexus Repository, are now available in AWS Marketplace, a digital catalog with thousands of software listings from independent software vendors that make it easy to find, test, buy, and deploy software that runs on Amazon Web Services (AWS).
Broadcom unveiled the latest updates to VMware Cloud Foundation (VCF), the company’s flagship private cloud platform.
CAST launched CAST SBOM Manager, a new freemium product designed for product owners, release managers, and compliance specialists.
Zesty announced the launch of its Insights and Automation Platform.
Progress announced the availability of Progress® MarkLogic® FastTrack™, a UI toolkit for building data- and search-driven applications to visually explore complex connected data stored in Progress® MarkLogic® platform.
Snowflake will host the Llama 3.1 collection of multilingual open source large language models (LLMs) in Snowflake Cortex AI for enterprises to easily harness and build powerful AI applications at scale.
Secure Code Warrior announced the availability of SCW Trust Agent – a solution that assesses the specific security competencies of developers for every code commit.
GFT launched AI Impact, a new solution that leverages artificial intelligence to eliminate technical debt, increase developer efficiency and automate critical software development processes.
Code Metal announced a $13M seed, led by Shield Capital.
Atlassian Corporation has achieved Federal Risk and Authorization Management Program (FedRAMP) “In Process” status and is now listed on the FedRAMP marketplace.
Check Point® Software Technologies Ltd. announced that it has received a Leader ranking in The Forrester Wave™: Mobile Threat Defense Solutions, Q3 2024 report.
Mission Cloud announced the launch of Mission Cloud Engagements - DevOps, a platform designed to transform how businesses manage and execute their AWS DevOps projects.
Accelario announces the release of its free TDM solution, including database virtualization and data anonymization.