Security firm Veracode Inc. has released its annual State of Software Security Report with a number of concerning findings in regards to the poor state of enterprise security.

The report, based based on 300,000 assessments run on enterprise applications over 18 months, found that the continued and persistent use of vulnerable components in software development is creating systemic risk in digital infrastructure, in particular, the use of open source software. In one example, a single particular component with a critical vulnerability then spread to more than 80,000 other software components, with those components then potentially being used in millions of programs.

Java topped the list, with a staggering 97 percent of apps written in the language found to have at least one vulnerability, and the use of a known vulnerable component from the Apache Commons Collection found in 25 percent of all Java apps scanned.

First discovered in November, the deserialization vulnerability allows remote executable exploits against several major middleware products including WebSphere, WebLogic and JBoss.

“The prevalent use of open-source components in software development is creating unmanaged, systemic risks across companies and industries,” Veracode Chief Marketing Officer Brian Fitzgerald said in a statement sent to SiliconANGLE. “Today, a cybercriminal can focus on a single vulnerability in one component to exploit millions of applications. Software components are used by every industry and for software of all kinds, and given our dependence on applications, the ease at which millions of applications can be breached has the potential to create havoc in our digital infrastructure and economy.”

The most common vulnerabilities in applications were found to be information leakage and cryptographic issues, affecting 72 percent and 65 percent of applications tested.

Other risks

Other sections of the report include an interesting finding that commercially developed applications are less secure than ones developed in-house. Seventy-five percent of commercial applications fail basic security checks compared to 61 percent of internally developed applications.

The healthcare industry is mentioned as one sector that is still struggling to fix vulnerabilities despite a number of high-profile breaches. But the same cannot be said for governments, which has improved their response in fixing security holes when they become aware of them.

It was not all bad news. The report noted that there is a growing trend of focusing on digital risk at the application layer and that more companies are realizing the importance of building security into DevOps processes to reduce risks going forward.

Image credit: Veracode