SlideShare a Scribd company logo

11th Website Security Statistics -- Presentation Slides (Q1 2011)

•
•
Jeremiah Grossman
Jeremiah Grossman

Website attacks continue to prevail despite the best efforts of enterprises to fight them. Websites are an ongoing business concern and security must be assured all the time, not just at a point in time. And yet, most websites were exposed to at least one serious vulnerability every day of 2010, leaving valuable corporate and customer date at risk. Why? In this report, Jeremiah will explore a new way to measure website security, Windows of Exposure, that tracks an organization’s current and historical website security posture. Window of Exposure is a useful combination of vulnerability prevalence, how long vulnerabilities take to get fixed, and the percentage of them that are remediated. By carefully tracking these metrics, an organization can determine where resources would be best invested. Using data from WhiteHat’s 11th Website Security Statistics Report, based on assessments of over 3,000 websites, Grossman will reveal the most secure (and insecure) vertical markets and the Windows of Exposure of each. Find out how your industry ranks, and the top ten vulnerabilities plaguing your peers. Learn how to determine which metrics are critical to increasing their remediation rates, thereby limiting their Window of Exposure. The good news is that companies that take this approach are increasing remediation rates by 5 percent per year.

Related slideshows

National Cyber Security Policy 2013 (NCSP)
National Cyber Security Policy 2013 (NCSP)National Cyber Security Policy 2013 (NCSP)
National Cyber Security Policy 2013 (NCSP)
 
455845434-Chapter-2-Cyber-Security-pptx.pptx
455845434-Chapter-2-Cyber-Security-pptx.pptx455845434-Chapter-2-Cyber-Security-pptx.pptx
455845434-Chapter-2-Cyber-Security-pptx.pptx
 
Vapt life cycle
Vapt life cycleVapt life cycle
Vapt life cycle
 
1 of 22
Download to read offline
Top Website Vulnerabilities: Trends, Business Effects & How to Fight Them Jeremiah Grossman Founder & Chief Technology Officer Webcast 03.03.2011 © 2011 WhiteHat Security, Inc.
Jeremiah Grossman • WhiteHat Security Founder & CTO • InfoWorld's CTO Top 25 for 2007 • Co-founder of the Web Application Security Consortium • Co-author: Cross-Site Scripting Attacks • Former Yahoo! information security officer 2
400+ enterprise customers •Start-ups to Fortune 500 Flagship offering “WhiteHat Sentinel Service” •Thousands of assessments performed annually Recognized leader in website security •Quoted thousands of times by the mainstream press 3
WhiteHat Sentinel Premium Edition (PE) - Production Sites – typically assessed by Consultants - Automated + Manual Testing - Verified Results Standard Edition (SE) NEW Sentinel PL Edition - Internal Sites – typically assessed by scanning tools - Automated Testing - Verified Results NEW PreLaunch (PL) - Pre-Production / QA – typically assessed by tools - Fast / Configurable Automated Testing - Verified Results - Can Augment or replace Code Review Tools Baseline Edition (BE) - Broad Based Coverage – static content - Self-service Automated Testing - Verified Results © 2010 WhiteHat Security, Inc. | Page 4
Vulnerability Coverage 5
Data Set • Data collected from January 1, 2006 to February 16, 2011 • ~500,000 verified Web application vulnerabilities (non-CVE) • Majority of websites assessed multiple times per month • Classified according to WASC Threat Classification "When you can measure what you are speaking about, and express it in numbers, you know something about it, when you cannot express it in numbers, your knowledge is of a meager and unsatisfactory kind; it may be the beginning of knowledge, but you have scarcely, in your thoughts advanced to the stage of science." - Lord Kelvin 6
Lesson: 1 Software will always have bugs and by extension, security vulnerabilities. A practical goal for a secure software development lifecycle (SDLC) should be to reduce, not necessarily eliminate, the number of vulnerabilities introduced and the severity of those that remain. Thank you Michael Howard (Microsoft) 7
Lesson: 2 Exploitation of just one website vulnerability is enough to significantly disrupt online business, cause data loss, shake customer confidence, and more. The earlier vulnerabilities are identified and the faster they are remediated the shorter the window of opportunity for an attacker to maliciously exploit them. 8
The security posture of a website must not only be measured by the number of vulnerabilities, but also must take into account remediation rates and time-to-fix metrics. 9
KPI: Window of Exposure Number of days [in a year] a website is exposed to at least one serious* reported vulnerability. Most websites were exposed to at least one serious* vulnerability every single day of 2010, or nearly so (9-12 months of the year). Only 16% of websites were vulnerable less than 30 days of the year overall.
Vulnerability Counting • Vulnerabilities are counted by unique Web application and class of attack. If three of the five parameters of a single Web application (/foo/ webapp.cgi) are vulnerable to SQL Injection, this is counted as 3 individual vulnerabilities (e.g. attack vectors). If a single parameter can be exploited in more than one way, each of those are counted as well. *  Serious  Vulnerabili/es:  Those  vulnerabili/es  with  a  HIGH,  CRITICAL,  or  URGENT  severity  as   defined  by  PCI-­‐DSS  naming  conven/ons.  Exploita/on  could  lead  to  breach  or  data  loss. 11
Average annual amount of new vulnerabilities introduced per website by industry (2010)
WhiteHat Security Top Ten (2010) Percentage likelihood of a website having at least one vulnerability sorted by class
Top 7 Vulnerabilities by Industry (2010) Percentage likelihood of a website having at least one vulnerability sorted by class
Time-to-Fix in Days by Industry (2010) On the average, 50% of organizations require 116 days or less to remediate their serious* vulnerabilities. The Banking industry being the fastest where 50% take under 13 days. The slowest is Telecommunications in that half need 205 days.
Remediation Rates by Industry (Trend) A 5% improvement in the percentage of reported vulnerabilities that have been resolved during each of the last three years (2008, 2009, 2010), which now resides at 53%. Progress!
2010 at a Glance Number  of   Std.   Remedia/on   Window  of   Industry Std.  Dev Vulns Dev Rate Exposure  (Days) Overall 230 1652 53% 40% 233 Banking 30 54 71% 41% 74 Educa/on 80 144 40% 36% 164 Financial  Services 266 1935 41% 40% 184 Healthcare 33 87 48% 40% 133 Insurance 80 204 46% 37% 236 IT 111 313 50% 40% 221 Manufacturing 35 111 47% 40% 123 Retail 404 2275 66% 36% 328 Social  Networking 71 116 47% 34% 159 Telecommunica/ons 215 437 63% 40% 260
Why do vulnerabilities go unfixed? • No one at the organization understands or is responsible for maintaining the code. • Development group does not understand or respects the vulnerability. • Feature enhancements are prioritized ahead of security fixes. • Lack of budget to fix the issues. • Affected code is owned by an unresponsive third-party vendor. • Website will be decommissioned or replaced “soon.” • Risk of exploitation is accepted. • Solution conflicts with business use case. • Compliance does not require fixing the issue. 18
Lesson: 3 Vulnerabilities do not exploit themselves. Someone or something, an attacker (or “threat”), uses an attack vector to exploit a vulnerability in a website, bypass a control, and cause a technical or business impact. Some attackers are sentient, and others are autonomous. Different attackers have different capabilities and goals in mind. 19
Lesson: 4 Some organizations are targets of opportunity, others targets of choice. • Targets of opportunity are victimized when their security posture is weaker than the average organization and the data they possess can be converted easily into liquid currency. • Targets of opportunity possess some form of unique and valuable information that is particularly attractive to an attacker. 20
If an organization is a target of opportunity, the goal of being at or above average with regard to website vulnerability numbers among your peers is reasonable. If a target of choice, then the adversary is one who will spend whatever time is necessary looking for gaps in the defenses to exploit. In this case, an organization must elevate its website security posture to a point where an attacker’s efforts are detectable, preventable, and in case of compromise, survivable. 21
Thank You! Blog: http://jeremiahgrossman.blogspot.com/ Twitter: http://twitter.com/jeremiahg Email: jeremiah@whitehatsec.com 22

More Related Content

11th Website Security Statistics -- Presentation Slides (Q1 2011)

  • 1. Top Website Vulnerabilities: Trends, Business Effects & How to Fight Them Jeremiah Grossman Founder & Chief Technology Officer Webcast 03.03.2011 © 2011 WhiteHat Security, Inc.
  • 2. Jeremiah Grossman • WhiteHat Security Founder & CTO • InfoWorld's CTO Top 25 for 2007 • Co-founder of the Web Application Security Consortium • Co-author: Cross-Site Scripting Attacks • Former Yahoo! information security officer 2
  • 3. 400+ enterprise customers •Start-ups to Fortune 500 Flagship offering “WhiteHat Sentinel Service” •Thousands of assessments performed annually Recognized leader in website security •Quoted thousands of times by the mainstream press 3
  • 4. WhiteHat Sentinel Premium Edition (PE) - Production Sites – typically assessed by Consultants - Automated + Manual Testing - Verified Results Standard Edition (SE) NEW Sentinel PL Edition - Internal Sites – typically assessed by scanning tools - Automated Testing - Verified Results NEW PreLaunch (PL) - Pre-Production / QA – typically assessed by tools - Fast / Configurable Automated Testing - Verified Results - Can Augment or replace Code Review Tools Baseline Edition (BE) - Broad Based Coverage – static content - Self-service Automated Testing - Verified Results © 2010 WhiteHat Security, Inc. | Page 4
  • 6. Data Set • Data collected from January 1, 2006 to February 16, 2011 • ~500,000 verified Web application vulnerabilities (non-CVE) • Majority of websites assessed multiple times per month • Classified according to WASC Threat Classification "When you can measure what you are speaking about, and express it in numbers, you know something about it, when you cannot express it in numbers, your knowledge is of a meager and unsatisfactory kind; it may be the beginning of knowledge, but you have scarcely, in your thoughts advanced to the stage of science." - Lord Kelvin 6
  • 7. Lesson: 1 Software will always have bugs and by extension, security vulnerabilities. A practical goal for a secure software development lifecycle (SDLC) should be to reduce, not necessarily eliminate, the number of vulnerabilities introduced and the severity of those that remain. Thank you Michael Howard (Microsoft) 7
  • 8. Lesson: 2 Exploitation of just one website vulnerability is enough to significantly disrupt online business, cause data loss, shake customer confidence, and more. The earlier vulnerabilities are identified and the faster they are remediated the shorter the window of opportunity for an attacker to maliciously exploit them. 8
  • 9. The security posture of a website must not only be measured by the number of vulnerabilities, but also must take into account remediation rates and time-to-fix metrics. 9
  • 10. KPI: Window of Exposure Number of days [in a year] a website is exposed to at least one serious* reported vulnerability. Most websites were exposed to at least one serious* vulnerability every single day of 2010, or nearly so (9-12 months of the year). Only 16% of websites were vulnerable less than 30 days of the year overall.
  • 11. Vulnerability Counting • Vulnerabilities are counted by unique Web application and class of attack. If three of the five parameters of a single Web application (/foo/ webapp.cgi) are vulnerable to SQL Injection, this is counted as 3 individual vulnerabilities (e.g. attack vectors). If a single parameter can be exploited in more than one way, each of those are counted as well. *  Serious  Vulnerabili/es:  Those  vulnerabili/es  with  a  HIGH,  CRITICAL,  or  URGENT  severity  as   defined  by  PCI-­‐DSS  naming  conven/ons.  Exploita/on  could  lead  to  breach  or  data  loss. 11
  • 12. Average annual amount of new vulnerabilities introduced per website by industry (2010)
  • 13. WhiteHat Security Top Ten (2010) Percentage likelihood of a website having at least one vulnerability sorted by class
  • 14. Top 7 Vulnerabilities by Industry (2010) Percentage likelihood of a website having at least one vulnerability sorted by class
  • 15. Time-to-Fix in Days by Industry (2010) On the average, 50% of organizations require 116 days or less to remediate their serious* vulnerabilities. The Banking industry being the fastest where 50% take under 13 days. The slowest is Telecommunications in that half need 205 days.
  • 16. Remediation Rates by Industry (Trend) A 5% improvement in the percentage of reported vulnerabilities that have been resolved during each of the last three years (2008, 2009, 2010), which now resides at 53%. Progress!
  • 17. 2010 at a Glance Number  of   Std.   Remedia/on   Window  of   Industry Std.  Dev Vulns Dev Rate Exposure  (Days) Overall 230 1652 53% 40% 233 Banking 30 54 71% 41% 74 Educa/on 80 144 40% 36% 164 Financial  Services 266 1935 41% 40% 184 Healthcare 33 87 48% 40% 133 Insurance 80 204 46% 37% 236 IT 111 313 50% 40% 221 Manufacturing 35 111 47% 40% 123 Retail 404 2275 66% 36% 328 Social  Networking 71 116 47% 34% 159 Telecommunica/ons 215 437 63% 40% 260
  • 18. Why do vulnerabilities go unfixed? • No one at the organization understands or is responsible for maintaining the code. • Development group does not understand or respects the vulnerability. • Feature enhancements are prioritized ahead of security fixes. • Lack of budget to fix the issues. • Affected code is owned by an unresponsive third-party vendor. • Website will be decommissioned or replaced “soon.” • Risk of exploitation is accepted. • Solution conflicts with business use case. • Compliance does not require fixing the issue. 18
  • 19. Lesson: 3 Vulnerabilities do not exploit themselves. Someone or something, an attacker (or “threat”), uses an attack vector to exploit a vulnerability in a website, bypass a control, and cause a technical or business impact. Some attackers are sentient, and others are autonomous. Different attackers have different capabilities and goals in mind. 19
  • 20. Lesson: 4 Some organizations are targets of opportunity, others targets of choice. • Targets of opportunity are victimized when their security posture is weaker than the average organization and the data they possess can be converted easily into liquid currency. • Targets of opportunity possess some form of unique and valuable information that is particularly attractive to an attacker. 20
  • 21. If an organization is a target of opportunity, the goal of being at or above average with regard to website vulnerability numbers among your peers is reasonable. If a target of choice, then the adversary is one who will spend whatever time is necessary looking for gaps in the defenses to exploit. In this case, an organization must elevate its website security posture to a point where an attacker’s efforts are detectable, preventable, and in case of compromise, survivable. 21
  • 22. Thank You! Blog: http://jeremiahgrossman.blogspot.com/ Twitter: http://twitter.com/jeremiahg Email: jeremiah@whitehatsec.com 22