WhiteHat Security Website Statistics [Full Report] (2013)

WEBSITE SECURITY STATISTICS REPORT | MAY 2013 1
WEBSITE SECURITY
STATISTICS REPORT
MAY 2013

WEBSITE SECURITY STATISTICS REPORT | MAY 20132
INTRODUCTION
WhiteHat Security’s Website Security Statistics Report provides a one-of-a-kind perspective on the state of
website security and the issues that organizations must address in order to conduct business online safely.
Website security is an ever-moving target. New website launches are common, new code is released
constantly, new Web technologies are created and adopted every day; as a result, new attack techniques are
frequently disclosed that can put every online business at risk. In order to stay protected, enterprises must
receive timely information about how they can most efficiently defend their websites, gain visibility into the
performance of their security programs, and learn how they compare with their industry peers. Obtaining
these insights is crucial in order to stay ahead and truly improve enterprise website security.
To help, WhiteHat Security has been publishing its Website Security Statistics Report since 2006. This report
is the only one that focuses exclusively on unknown vulnerabilities in custom Web applications, code that
is unique to an organization, and found in real-world websites. The underlying data is hundreds of terabytes
in size, comprises vulnerability assessment results from tens of thousands of websites across hundreds of the
most well-known organizations, and collectively represents the largest and most accurate picture of website
security available. Inside this report is information about the most prevalent vulnerabilities, how many get
fixed, how long the fixes can take on average, and how every application security program may measurably
improve. The report is organized by industry, and is accompanied by WhiteHat Security’s expert analysis and
recommendations.
Through its Software-as-a-Service (SaaS) offering, WhiteHat Sentinel, WhiteHat Security is uniquely positioned
to deliver the depth of knowledge that organizations require to protect their brands, attain compliance, and
avert costly breaches.
ABOUT WHITEHAT SECURITY
Founded in 2001 and headquartered in Santa Clara, California, WhiteHat Security provides end-to-end
solutions for Web security. The company’s cloud website vulnerability management platform and leading
security engineers turn verified security intelligence into actionable insights for customers. Through a
combination of core products and strategic partnerships, WhiteHat Security provides complete Web security
at a scale and accuracy unmatched in the industry. WhiteHat Sentinel, the company’s flagship product line,
currently manages more than 15,000 websites – including sites in the most regulated industries, such as top
e-commerce, financial services and healthcare companies.

N
EXECUTIVE SUMMARY

KEY FINDINGS

2007
1000
800
400
600
200
2008 2009 2009 2010 2011
AT A GLANCE:
THE CURRENT STATE OF WEBSITE SECURITY

MOST COMMON VULNERABILITIES

Cross-Site Scripting
Information Leakage
Content Spoofing
Cross-Site Request Forgery
Brute Force
Insufficient Transport Layer Protection
Insufficient Authorization
SQL
Other
43%
11%
7%
12%
13%
injection

C-level executives, managers, and software developers often ask their security teams, “How are
we doing? Are we safe, are we secure?” The real thing they may be asking for is a sense of how
the organization’s current security posture compares to their peers or competitors. They want
to know if the organization is leading, falling way behind, or is somewhere in between with
respect to their security posture. The answers to that question are extremely helpful for progress
tracking and goal setting.
What many do not first consider is that some organizations (or particular websites) are ‘targets
of opportunity,’ while others are ‘targets of choice.’ Targets of opportunity are breached when
their security posture is weaker than the average organization (in their industry) – and they get
unlucky in the total pool of potential victims. Targets of choice possess some type of unique
and valuable information, or perhaps a reputation or brand that is particularly attractive to a
motivated attacker. The attackers know precisely whom – or what – they want to penetrate.
Here’s the thing: since ‘100% security’ is an unrealistic goal – mostly because it is flatly
impossible, and the attempt is prohibitively expensive and for many completely unnecessary
– it is imperative for every organization to determine if they most likely represent a target of
opportunity or choice. In doing so an organization may establish and measure against a “secure
enough” bar.
If an organization is a target of opportunity, a goal of being just above average with respect to
website security among peers is reasonable. The bad guy will generally prefer to attack weaker,
and therefore easier to breach, targets. On the other hand, if an organization is a target of
choice, that organization must elevate its website security posture to a point where an attacker’s
efforts are detectable, preventable, and in case of a compromise, survivable. This is due to the
fact that an adversary will spend whatever time is necessary looking for gaps in the defenses to
exploit.
Whether an organization is a target of choice or a target of opportunity, the following Industry
Scorecards have been prepared to help organizations to visualize how its security posture
compares to its peers (provided they know their own internal metrics, of course).
INDUSTRY SCORECARDS

MOST COMMON
VULNERABILITIES
AT A GLANCE
EXPOSURE AND CURRENT DEFENSE
PERCENT OF SERIOUS*
VULNERABILITIES
THAT HAVE BEEN FIXED
AVERAGE TIME
TO FIX
PERCENT OF ANALYZED
SITES WITH A SERIOUS*
VULNERABILITY
AVERAGE NUMBER OF
SERIOUS* VULNERABILITIES
PER SITE PER YEAR
81%
54%
107
DAYS
11
Cross-Site
Scripting*
Information
Leakage*
Content
Spoofing*
Cross-Site
Request Forgery*
Brute Force* Fingerprinting* Insufficient
Authorization*
30%
20%
10% 26% 21% 9% 9% 8% 8% 5%
Banking Industry ScorecardApril 2013
24% 33% 9% 11% 24%
THE CURRENT
STATE OF
WEBSITE SECURITY
TOP SEVEN
VULNERABILITY
CLASSES
CURRENT APPLICATION SECURITY BEHAVIORS AND CONTROLS
USED BY ORGANIZATIONS
*The percent of sites that had at least one example of...
*Serious vulnerabilities are deﬁned as those in which an attacker could take control over all, or a part, of a website, compromise user accounts, access sensitive data or violate compliance requirements.
DAYS OVER A YEAR THAT A SITE IS EXPOSED TO SERIOUS* VULNERABILITIES
Programmers receive instructor led or computer-based software security training
Applications contain a library or framework that centralizes and enforces security controls
Perform Static Code Analysis on their website(s) underlying applications
Web Application Firewall Deployed
Transactional / Anti-Fraud Monitoring System Deployed
80%
100%
60%
40%
20% 57% 29%57%29% 71%
24% Always Vulnerable
33% Frequently Vulnerable 271-364 days a year
9% Regularly Vulnerable 151-270 days a year
11% Occasionally Vulnerable 31-150 days a year
Rarely Vulnerable 30 days or less a year

MOST COMMON
VULNERABILITIES
AT A GLANCE
PERCENT OF SERIOUS*
VULNERABILITIES
AVERAGE TIME
TO FIX
PERCENT OF ANALYZED
VULNERABILITY
AVERAGE NUMBER OF
PER SITE PER YEAR
81%
67%
226
DAYS
50
Cross-Site
Scripting*
Information
Leakage*
Content
Spoofing*
SQL injection*Cross-Site
request Forgery*
Brute Force* Directory
Indexing*
30%
20%
10% 31% 25% 12% 9% 8% 7% 7%
Financial Services
Industry Scorecard
THE CURRENT
STATE OF
WEBSITE SECURITY
TOP SEVEN
VULNERABILITY
CLASSES
80%
100%
60%
40%
20% 64% 70%50%50% 40%
23% Rarely Vulnerable 30 days or less a year
28% 28% 10% 10% 23%

MOST COMMON
VULNERABILITIES
AT A GLANCE
PERCENT OF SERIOUS*
VULNERABILITIES
AVERAGE TIME
TO FIX
PERCENT OF ANALYZED
VULNERABILITY
AVERAGE NUMBER OF
PER SITE PER YEAR
90%
53%
276
DAYS
22
Cross Site
Scripting*
Information
Leakage*
Content
Spoofing*
Brute Force*Insufficent
Transport
Layer Protection*
Cross Site
Request
Forgery*
Session
Fixation*
30%
20%
10% 40% 29% 22% 13% 12% 10% 9%
Healthcare Industry ScorecardApril 2013
THE CURRENT
STATE OF
WEBSITE SECURITY
TOP SEVEN
VULNERABILITY
CLASSES
80%
100%
60%
40%
20% 67% 67%83%50% 34%
49% 22% 12% 7% 10%

MOST COMMON
VULNERABILITIES
AT A GLANCE
PERCENT OF SERIOUS*
VULNERABILITIES
AVERAGE TIME
TO FIX
PERCENT OF ANALYZED
VULNERABILITY
AVERAGE NUMBER OF
PER SITE PER YEAR
91 %
54%
224
DAYS
106
Cross Site
Scripting*
Information
Leakage*
Content
Spoofing*
Brute Force* SQL Injection*Cross Site
Request
Forgery*
Directory
Indexing*
30%
20%
10% 31% 25% 12% 9% 8% 7% 7%
Retail Industry ScorecardApril 2013
THE CURRENT
STATE OF
WEBSITE SECURITY
TOP SEVEN
VULNERABILITY
CLASSES
80%
100%
60%
40%
20% 73% 60%90%70% 70%
54% 21% 6% 5% 13%

MOST COMMON
VULNERABILITIES
AT A GLANCE
PERCENT OF SERIOUS*
VULNERABILITIES
AVERAGE TIME
TO FIX
PERCENT OF ANALYZED
VULNERABILITY
AVERAGE NUMBER OF
PER SITE PER YEAR
85%
61 %
71
DAYS
18
Cross-Site
Scripting*
Information
Leakage*
Content
Spoofing*
Cross-Site
Request Forgery*
Brute Force*Fingerprinting* URL Redirector
Abuse*
30%
20%
10% 41% 35% 19% 18% 14% 12% 12%
Technology
Industry ScorecardApril 2013
5% 64% 10% 9% 11%
THE CURRENT
STATE OF
WEBSITE SECURITY
TOP SEVEN
VULNERABILITY
CLASSES
80%
100%
60%
40%
20% 48% 52%96%72% 32%

SURVEY

(Figure 7) (Figure 8)

(Figure 9)

(Figure 11).(Figure 10)

(Figure 18)

(Figure 20)

(Figure 24)
(Figure 23)

Figure 25).

Answer:
SOFTWARE
DEVELOPMENT
Answer:
SECURITY
DEPARTMENT
Answer:
BOARD OF DIRECTORS
Answer:
EXECUTIVE
MANAGEMENT
Question:If an organization experiences a website(s) data
or system breach, which part of the organization is held
accountable and and what is its performance?
3rd
1St
2nd
4th
4th
3rd
3rd
1st
3rd
2nd
1st
2nd
Average Vulnerabilities
per Site Ranking
Average Time to Fix a
Vulnerability Ranking
Average Number of
Vulnerabilities Fixed Ranking

(Figure 37). (Figure 38).
(Figure 39). (Figure 40).

RECOMMENDATIONS

•
•
•
•
•

Top 10 Vulnerability Classes (2011)
(Sorted by vulnerability class)
Overall Vulnerability Population (2011)
Percentage breakdown of all the serious* vulnerabilities discovered
(Sorted by vulnerability class)

WhiteHat Security Website Statistics [Full Report] (2013)

Related slideshows

More Related Content

WhiteHat Security Website Statistics [Full Report] (2013)