WhiteHat Security surveys customers and examines terabytes of data collected from websites
and applications it monitors to annually produce a report that concentrates on unknown vulnerabilities in custom Web applications. Custom has the same meaning here as a "custom made suit": organizations may operate websites using commercial or open source operating systems, web server software and content management systems, but nearly every site of meaningful size has code that is unique to that organization.
Unique code doesn't necessarily translate to unique vulnerabilities: software developers worldwide make similar assumptions, use similar dev languages and tools... and being human, some make errors in logic, poor or uninformed assumptions about program execution or user behavior, and test in haste or without rigor. These are the causes of unknown vulnerabilities that attackers discover and exploit.
While much
of the WhiteHat Security's Report is devoted to sharing the numbers -
and most of the numbers are unsurprising confirmations of what OWASP
reports or what front line infosec professionals see every day - the
WhiteHat Security team looks past the numbers, consider factors that are
not always obvious to audiences of this kind of report, and most
usefully, share their opinions. Read the Report, not just the Executive Summary. Perhaps you'll conclude, as I did, that this one finding is the important takeaway if you want improve your website security profile:
What's needed is secure software NOT more security software
Not a believer? If your organizations' strategy to prevent leakage, exploitation or abuse relies on deploying firewalls and intrusion detection systems, consider these findings:
- Organizations that provide software security training had 40% fewer vulnerabilities and resolved them 59% faster.
- Organizations that use web application firewalls had 11% more vulnerabilities and resolved them 8% slower.
- Organizations that make use of application libraries or frameworks to centralize and enforce security controls experienced 64% more vulnerabilities, resolved them 27% slower.
Those who read the Report will note that I've discounted remediation rate when citing findings. As the Report notes, developers have little control over which bugs are fixed or when. These decisions are made based on other business considerations and in my opinion lend little to this conversation; in particular, I suggest you see how your organization fares as you read the section entitled Factors Inhibiting Organizations from Remediating Vulnerabilities.
I'm not suggesting that you toss security software and systems aside and only invest in software security training and disciplined secure code development. I am suggesting that (a) here's good evidence that you ought to invest in software security training and (b) if you want to improve website security, you must recognize that security software and systems at best provide complementary measures. These are additional lines of defense at best; at worst, they sap talent and funding away from secure software projects.
Custom application code is
the primary target for website attackers. Focus your security
budget on mitigating this problem.
Still not convinced? The Report also finds that organizations whose web site experienced a data or system breach as a result of an application layer vulnerability had 51% fewer vulnerabilities and resolved them 18% faster.
While there is still nothing that makes believers quicker than a breach, you can wait until you become a victim or use this Report and begin to effect change.
Note: I want to thank Jeremiah Grossman for taking time to respond thoroughly and candidly to questions I had after my first read of the Report.