Video: Data mining a mountain of vulnerabilities

Every day, software developers around the world, from Bangalore to Silicon Valley, churn out millions of lines of insecure code.

Veracode used static binary analysis on thousands of applications submitted to them by large enterprises, commercial software vendors, open source projects, and software outsourcers, to create an anonymized vulnerability data set. By mining this data we can answer some interesting questions.

There are significant differences in the quantity and types of vulnerabilities in software due to differences in where the software was developed, the type of software it is, in what language it was developed, and for what type of business the software was developed for.

Which industries have the most secure and least secure code? What types of mistakes do developers make most often? Which languages and platforms have the apps with the most vulnerabilities? Should you be most worried of internally built apps, open source, commercial software, or outsourcers? How do latent vulnerabilities relate to those most often exploited. These questions and many more will be answered as we tunnel through vulnerability mountain.

Here’s the video, recorded at Hack in The Box 2012:

Chris Wysopal

Chris Wysopal (AKA Weld Pond), Veracode’s CTO and Co-Founder, is responsible for the company’s software security analysis capabilities.

One of the original vulnerability researchers and a member of L0pht Heavy Industries, he has testified on Capitol Hill in the US on the subjects of government computer security and how vulnerabilities are discovered in software.

Chris was one of the first vulnerability researchers for web applications and Windows, publishing advisories in Lotus Domino, Cold Fusion, and Windows back in the mid 1990′s. Around the same time he also co-authored L0phtCrack, which he still sells today, and ported netcat to Windows.