The government is falling behind on application security

Three out of four government applications fail the OWASP Top 10 and the government is slacking off on fixing flaws, Veracode found

Top 10 application vulnerability categories by industry vertical

Top 10 application vulnerability categories by industry vertical

Government organizations are struggling when it comes to securing the computer software they use, which could partially explain the large data breaches reported in that sector over the past several years.

Three out of four applications used by government organizations are not compliant with one of the primary software security policies and most of the flaws found in them never get fixed, according to a report released Tuesday by U.S.-based application security firm Veracode.

The report is based on an analysis of more than 200,000 applications over the past 18 months that are used by organizations in various industries. The tests were performed using Veracode's cloud-based application security testing platform that uses static analysis, dynamic analysis and manual penetration testing techniques.

The company found that only 24 percent of applications submitted for review by government customers were compliant with the OWASP Top 10, a list of the top 10 most common types of vulnerabilities for Web applications, complete with explanations of the risks they pose, code examples and guidance on how to avoid them. The OWASP Top 10 is referenced by many other standards, including the Payment Card Industry Data Security Standard (PCI DSS).

By contrast, applications from the financial services sector had an OWASP Top 10 compliance rate of 42 percent, those from the manufacturing sector, 35 percent, and those used by technology companies, 32 percent. Applications used in the health care and the retail and hospitality sectors had a compliance rate of 31 and 30 percent, respectively -- both of these sectors having been plagued by large data breaches in recent years.

There are multiple reasons why the government is scoring badly on application security, according to Chris Wysopal, the chief technology officer of Veracode. These include the government's use of old scripting and programming languages, its failure to self regulate and its failure to impose security requirements on its software suppliers.

The government sector still uses a lot of legacy code written in languages like ColdFusion or Classic ASP that were popular in the 1990s, Wysopal said. Other industries have moved away from those and are now largely focusing on languages like .NET or Java that are faster, and where it's harder to make certain errors, he said.

In other industry sectors like financial services there's strong competition between companies, which drives them to modernize their systems and applications, but that competitive pressure doesn't exist inside the government, Wysopal said.

Using older programming languages wouldn't be such a big problem if the government would routinely fix the identified flaws. Sadly, Veracode's data shows that the government's remediation rate for flaws found in its applications is only 27 percent.

The company saw a high level of legacy code use in the manufacturing sector as well, but by comparison, those companies patched 80 percent of their application flaws. That vulnerability remediation rate was even higher than that of financial services companies, which are a primary target for hackers and are typically more diligent.

Another important aspect that contributes to the problem is that the government's approach to security is very compliance oriented instead of being based on assessing risk.

Government organizations wait for orders from the Government Accountability Office or are implementing standards from the National Institute of Standards and Technology, and this means that their security is moving very slowly because those regulations take many years to change, Wysopal said.

Meanwhile, the field of application security has rapidly grown in prominence over the past five years with the rise of Web and mobile applications. These applications allow organizations to provide valuable new services, but at the same time add a lot of risks and need to be covered by their security programs, he said.

There's also a lack of sanctions for government organizations, according to Wysopal. By comparison, healthcare or financial organizations have to follow strict data protection rules and risk serious fines if their sensitive customer information is compromised.

"Who's getting fined for the recent breach at the Office of Personnel Management that exposed information on millions of current and former federal employees?" Wysopal said. "Nobody, because the government doesn't really hold itself accountable like it holds others."

Another aspect that plays into the poor state of application security inside government organizations is that most of the applications they use are either purchased from third-parties or are developed by outsourcing firms. Veracode's data shows that less than one in three commercial applications that were purchased by organizations from third-party software suppliers were compliant with the OWASP Top 10 when first tested.

Outsourcing software development is not a problem per se, as financial services or manufacturing companies rely heavily on this practice too, Wysopal said. However, those companies have better application security because they have requirements in place for their software suppliers, such as mandatory third-party security testing or compliance with certain security standards. "We don't see that inside the government," he said.

This should serve as a wake-up call to everybody, Wysopal said. Organizations should look at their software supply chains, put security requirements in their contracts and test the applications they're getting so they can hold vendors accountable, he said.

When it comes to vulnerability remediation Veracode found that many companies don't fix some of the flaws found in their applications because they lack people with application security expertise. Because of that, the vulnerability reports keep piling up and never get fixed.

Companies have understood that they need to do more application security testing, but they're having trouble solving the problems they find, Wysopal said. Companies should definitely invest in application security training for their developers, but in the meantime they can also look externally to security companies that can provide assistance on fixing application flaws as a service, he said.

Join the newsletter!

Error: Please check your email address.
Rocket to Success - Your 10 Tips for Smarter ERP System Selection

Tags securityVeracodedata breachExploits / vulnerabilitiesdata protectionCompliance monitoring

Keep up with the latest tech news, reviews and previews by subscribing to the Good Gear Guide newsletter.

Lucian Constantin

IDG News Service
Show Comments

Cool Tech

Breitling Superocean Heritage Chronographe 44

Learn more >

SanDisk MicroSDXC™ for Nintendo® Switch™

Learn more >

Toys for Boys

Family Friendly

Panasonic 4K UHD Blu-Ray Player and Full HD Recorder with Netflix - UBT1GL-K

Learn more >

Stocking Stuffer

Razer DeathAdder Expert Ergonomic Gaming Mouse

Learn more >

Christmas Gift Guide

Click for more ›

Most Popular Reviews

Latest Articles

Resources

PCW Evaluation Team

Walid Mikhael

Brother QL-820NWB Professional Label Printer

It’s easy to set up, it’s compact and quiet when printing and to top if off, the print quality is excellent. This is hands down the best printer I’ve used for printing labels.

Ben Ramsden

Sharp PN-40TC1 Huddle Board

Brainstorming, innovation, problem solving, and negotiation have all become much more productive and valuable if people can easily collaborate in real time with minimal friction.

Sarah Ieroianni

Brother QL-820NWB Professional Label Printer

The print quality also does not disappoint, it’s clear, bold, doesn’t smudge and the text is perfectly sized.

Ratchada Dunn

Sharp PN-40TC1 Huddle Board

The Huddle Board’s built in program; Sharp Touch Viewing software allows us to easily manipulate and edit our documents (jpegs and PDFs) all at the same time on the dashboard.

George Khoury

Sharp PN-40TC1 Huddle Board

The biggest perks for me would be that it comes with easy to use and comprehensive programs that make the collaboration process a whole lot more intuitive and organic

David Coyle

Brother PocketJet PJ-773 A4 Portable Thermal Printer

I rate the printer as a 5 out of 5 stars as it has been able to fit seamlessly into my busy and mobile lifestyle.

Featured Content

Product Launch Showcase

Latest Jobs

Don’t have an account? Sign up here

Don't have an account? Sign up now

Forgot password?