Application Security Report Calls Out Problems in Mobile, IoT Devices and DevOps

Source – securityintelligence.com

Vulnerabilities in mobile backends, web interfaces to the Internet of Things (IoT) and negligent DevOps practitioners are among the fastest growing application security threats, according to a report released at the InfoSecurity Europe conference in London this week.

What’s the Problem?

Research from High-Tech Bridge, a Swiss company that also operates in the U.S., said 83 percent of web service and application programming interfaces (APIs) used in apps for retail, banking and other markets could fall prey to XML or SQL injections.

The report, which is based on data from publicly available sources and the application security testing platform ImmuniWeb, cited problems such as poor encryption and admin credentials that can’t be modified in 98 percent of IoT devices. Additionally, while DevOps is a popular way to create applications quickly, the report said two-thirds of companies using this methodology had at least one high-risk vulnerability affecting an external application.

Addressing Application Security Threats

Many companies have tried to mitigate these kinds of application security risks by offering cash rewards to white-hat hackers who try to discover potential bugs or vulnerabilities. However, Help Net Security noted that the High-Tech Bridge report showed these bug bounty programs aren’t proving very effective: At least two major vulnerability were undiscovered by these individuals in 9 out of 10 bug bounty programs that had been running for a year or longer.

There’s no question enterprises need more than bug bounties to keep up with application security problems. For example, attacks based on cross-site scripting (XSS) were also called out as one of the most common vulnerabilities in the report, and they are among the most difficult to catch. Just a few weeks ago, for instance, Threatpost explained how Verizon had to patch an XXS vulnerability discovered in its messaging client.

Not everything in the application security report was negative. Tech Republic highlighted one finding from High-Tech Bridge, which explained that vast majority of mobile app code — as much as 95 percent — is not at risk from cyberattackers. Despite this, the report also said companies should be working harder to protect web servers, improve web application firewalls and harden HTTPS encryption.