It takes 248 days for IT businesses to fix their software vulnerabilities

Compiled using data collected from tens of thousands of websites, a new WhiteHat Security report reveals that the majority of web applications exhibit, on average, two or more serious vulnerabilities per application for every industry at any given point in time.

The report’s findings are based on the aggregated vulnerability scanning and remediation data from web applications that use the WhiteHat Sentinel service for application security testing. The research shows that no industry has mastered application security, and of the 12 industries analyzed in this report, the IT, education, and retail industries suffer the highest number of critical or high-risk vulnerabilities per web application, at 17, 15 and 13 respectively.

The findings also highlight that the IT and retail industries struggle to remediate in a timely manner. It takes 248 days for IT and 205 days for retail businesses to fix their software vulnerabilities.

According to the “Window of Exposure” data in the report, another key metric organizations need to pay attention to is the number of days an application has one or more serious vulnerabilities open during a given time period. Across all industries, a substantial number of web applications remain always vulnerable. A few key highlights:

• IT – 60 percent of web applications are always vulnerable
• Retail – half of all web applications are always vulnerable
• Banking and financial services – 40 and 41 percent of web applications are always vulnerable, respectively
• Healthcare – 47 percent of web applications are always vulnerable.

Remediation rates

The report also captures data on vulnerabilities that are fixed once they are discovered. Generally, the more critical the vulnerability, the more complex they are to understand and remediate. For nine of the 12 industries analyzed, remediation rates are below 50 percent. In IT, less than 25 percent of open vulnerabilities are remediated, and vulnerabilities in this industry have an average age of 875 days. The average time-to-fix for vulnerabilities varies by industry from approximately 15 weeks in the energy industry to 35 weeks in IT.

Key trends from 2013 – 2015 include:

• Remediation rates declined significantly in IT, which saw a drop from 46 percent to 24 percent, and in banking, which dropped from 52 percent to 42 percent
• Financial services and retail saw modest increases in their remediation rates, from 41 percent to 48 percent for financial services, and from 42 percent to 48 percent for retail
• The greatest improvement was in the food & beverage industry, where remediation rates quadrupled, from 17 percent to 62 percent
• In manufacturing, rates almost doubled from 34 percent to 66 percent, while healthcare and insurance increased from 26 percent to 42 percent, and 26 percent to 44 percent, respectively.

“Since 2013, the average time to fix vulnerabilities has trended upward overall, but we’ve seen some great successes with customers who have embedded security into the software development process,” said Ryan O’Leary, Vice President, Threat Research Center and Technical Support, WhiteHat Security. “Discovering vulnerabilities in development is key to reducing vulnerabilities when the application is staged. Introducing source scanning, or SAST, has the potential to eliminate 80-90% of well-known vulnerabilities. We look forward to seeing how this report will evolve as security and development teams work together more closely around shared security and risk management goals.”