SLIDE 1
The Data Set
- Applications from over 300
commercial and US government customers
- Scanned 9,910
applications over past 18 months
- Ranged in size from 100KB
to 6GB
- Software was pre-release
and in production
- Internally built, outsourced,
Data Mining a Mountain of Chris Wysopal CTO & Co-founder Zero - - PowerPoint PPT Presentation
Data Mining a Mountain of Chris Wysopal CTO & Co-founder Zero - - PowerPoint PPT Presentation
Data Mining a Mountain of Chris Wysopal CTO & Co-founder Zero Day Vulnerabilities The Data Set Applications from over 300 commercial and US government customers Scanned 9,910 applications over past 18 months Ranged in size
SLIDE 2
SLIDE 3
▸ Industry vertical ▸ Application supplier (internal, third- party, etc.) ▸ Application type ▸ Assurance level ▸ Language ▸ Platform
Applicatio n Data
▸ Scan number ▸ Scan date ▸ Lines of code
Scan Data
▸ Flaw counts ▸ Flaw percentages ▸ Application count ▸ Risk-adjusted rating ▸ First scan acceptance rate ▸ Time between scans ▸ Days to remediation ▸ Scans to remediation ▸ PCI-DSS (pass/ fail) ▸ CWE/SANS Top25 (pass/fail) ▸ OWASP Top Ten (pass/fail) ▸ Custom policies
Enterpris e Metrics
SLIDE 4
SLIDE 5
The latent Vulnerabiliesvs. The Attacks
SLIDE 6
Top 5 Attacked Web Application Vulnerabilities
SLIDE 7
Let’s take a closer look at the numbers
SLIDE 8
SLIDE 9
SLIDE 10
SLIDE 11
SLIDE 12
Top 3 Vulnerabilities by Language
SLIDE 13
Top 3 Vulnerabilities by Language
SLIDE 14
Different developers deliver different vulns
SLIDE 15
Different developers deliver different vulns
Vulnerability distribution by industry ulnerability distribution by industry
SLIDE 16
Are DEVELOPERs making any progress at eradicating cross- site scripting or sql injection?
SLIDE 17
SLIDE 18
SLIDE 19
Dare we ask, How is the U.S. government sector doing?
SLIDE 20
SLIDE 21
SLIDE 22
What percentage
- f WEB
applications fail OWASP TOP TEN?
a) 34% b) 57% c) 86% d) 99%
SLIDE 23
SLIDE 24
SLIDE 25
Who is holding their software vendors accountable?
SLIDE 26
SLIDE 27
SLIDE 28
So I hear you can run applications on smart phones?
SLIDE 29
SLIDE 30
SLIDE 31
When given an exam on application security fundamentals,
- ver half of
developers…
a) Receive an A b) Receive a B or worse c) Receive a C or worse d) Fail (receive a D or F)
SLIDE 32
SLIDE 33
SLIDE 34