UPDATED 08:00 EDT / MAY 27 2021

SECURITY

New report finds 67% of applications in the utility sector have serious vulnerabilities

With the Colonial Pipeline ransomware attack still making headlines and resulting in new government policy, a new report from application security provider WhiteHat Security Inc. finds that companies across multiple industries remain exposed to future attacks.

WhiteHat’s monthly Appsec Stats Flash report released today found that the Window of Exposure, a key metric indicative of breach exposure for applications, has increased from 55% to 67% in the utility sector since the start of the year. The figure makes applications in the utility sector the second most vulnerable to attacks behind public administration applications.

Overall, the report finds, 67% of applications in the utility sector have at least one exploitable severe vulnerability open throughout the year.

Not all industries reported worsening numbers. The Window of Exposure in manufacturing decreased from 70% to 64% over the last 12 months and the figure dropped from 59% to 52% in the healthcare sector.

The top five vulnerability classes over the last three months have remained constant. Topping the list was information leakage, followed by insufficient session expiration, cross-site scripting, insufficient transport layer protection and content spoofing.

Setu Kulkarni, vice president of strategy at WhiteHat Security, told SiliconANGLE that online applications used on the web and mobile devices are the most at risk.

“These applications allow companies and service providers to make their services and products available to hundreds of millions of customers,” Kulkarni explained. “Consequently, these applications are critical to these companies and service providers to continue their operations as virtually every interaction these days has an online aspect to it.”

Application security vulnerabilities can cause serious reputational, financial, compliance and operational risk to an organization, which in turn can result in a decline in the quality of service or product they deliver to their end customers, Kulkarni added. “While the recent Colonial Pipeline cyberattack was a ransomware attack, its repercussions are an example of the risks that exist with vulnerable applications as well,” he said.

Sean Nikkel, senior cyber threat intel analyst at digital risk protection firm Digital Shadows Ltd., noted that applications and infrastructure should have strong security policies in place and have some level of control by the information technology department or a risk management body, but sometimes speed and convenience can overtake the need for security.

“An example of this might be a document-sharing application or a cloud server with the barest of controls in place and no one thought to go back and secure it or develop better policies around its use,”  Nikkel said. “Multiple teams could be using various applications to solve the same problem, which leads to haphazard deployments. As these applications are phased out, or a project ends, you end up with an application or an unsecured S3 bucket sitting out there waiting for someone to grab the data.”

Image: WhiteHat Security

A message from John Furrier, co-founder of SiliconANGLE:

Your vote of support is important to us and it helps us keep the content FREE.

One click below supports our mission to provide free, deep, and relevant content.  

Join our community on YouTube

Join the community that includes more than 15,000 #CubeAlumni experts, including Amazon.com CEO Andy Jassy, Dell Technologies founder and CEO Michael Dell, Intel CEO Pat Gelsinger, and many more luminaries and experts.

“TheCUBE is an important partner to the industry. You guys really are a part of our events and we really appreciate you coming and I know people appreciate the content you create as well” – Andy Jassy

THANK YOU