At least 50% of applications used in sectors such as construction, public services , healthcare, retail, education and utilities contain one or more serious exploitable vulnerabilities, according to a new study by WhiteHat Security . This is linked to the digital transition in most sectors over the past year, which has increased the number of applications in use.
Construction had the highest “window of exposure,” with nearly 70% of applications used in the industry having at least one serious exploitable vulnerability, according to the AppSec Stats Flash Volume 2, a monthly analysis that began this year.
The top five vulnerability “classes” recorded by WhiteHat in the previous three months were information leakage, inadequate session expiration, cross site scripting, inadequate transport layer protection, and content forgery
The report's authors noted that the effort and skill required to discover and exploit these vulnerabilities is quite low, thus making it easier for the "adversary."
As Infosecurity Magazine reports, part of the problem appears to be the high average time it takes to fix critical vulnerabilities, which was revealed to be 189 days across all industries. However, there was a five-day improvement in the 12-month average compared to the previous month, down from 194 days . Notably, three industries – education, government and real estate – took an average of more than a year to fix critical vulnerabilities.
Setu Kulkarni, Vice President of WhiteHat Security, commented on the fact that 50% of applications have at least one exploitable vulnerability, noting the following: “In 2021, we have more detailed security and breach data than ever before. However, the state of application security remains very concerning. No application is built the same, and therefore each presents a completely unique attack. This, combined with the fact that applications today are increasingly polymorphic, presenting web, mobile, and API-, makes security application
The fact that at least 50% of applications have one or more exploitable vulnerabilities should immediately wake up all industries, so that measures can be taken to best address and prevent potential threats.
