Veracode: software security still lagging in public sector

Share
The research comes in the midst of government initiatives to strengthen cybersecurity, which include efforts to reduce vulnerabilities in applications that perform critical government functions.
Veracode’s State of Software Security Public Sector 2023 report finds security flaws in 82% of government applications, suggesting a need for cyber safety

Leading intelligent software security provider, Veracode, have released research indicating that applications developed by public sector organisations tend to have more security flaws than those of the private sector. These findings have demonstrated a definite need to continue working towards equalities between sectors to ensure cyber safety for all.

The Veracode State of Software Security 2023 findings suggest an increased number of flaws and vulnerabilities in applications correlate with increased levels of risk. The research comes in the midst of government initiatives to strengthen cybersecurity, which include efforts to reduce vulnerabilities in applications that perform critical government functions.

A need to close the gap between private and public

Researchers found that just under 82% of applications developed by public sector organisations had at least one security flaw detected in their most recent scan over the last 12 months, compared to 74 percent of private sector organisations. Depending on the type of flaw tracked, public sector applications had a 7–12% higher probability of having a flaw introduced in the last 12 months.

"The difference between the rate at which flaws appear in public and private sector applications is significant. Efforts by the government to close the gap are necessary and should continue,” said Chris Eng, Chief Research Officer at Veracode.

“As stewards of public safety, agencies have a responsibility to close this gap and strengthen security to protect the nation and its citizens.”

Analysis of data collected from more than 27 million scans across 750,000 applications helped to produce Veracode’s latest annual report on the State of Software Security. This new report showcases public sector-specific findings from those scans and applications, including results from governments across the world.

Public sector excel at discovering ‘High Severity Flaws’

Veracode’s research also found that public sector organisations are adept at detecting “high severity flaws” (16.5%) in a 12-month period, despite not discovering as many as non-public sector applications (19%). This is still significant because high severity flaws, when exploited, have greater potential to impact systems adversely. 

Modern application testing encourages use of multiple security scanning tools, such as static application security testing (SAST) and software composition analysis (SCA), because different scan types excel at uncovering different types of flaws. Ultimately, according to the report, SAST and SCA found application flaws in a smaller percentage of public sector agencies compared to private sector applications.

Veracode suggests that a significant difference between public and private sector applications is the rate that scans discover new flaws in ageing software. After five years in production, the two sectors show stark differences, as the rate of new flaws introduced in private sector applications increase, as opposed to rates for public sector agencies decrease. 

According to the report, this trend is suggestive of public sector agencies being more vigilant about keeping applications secure over time, and not just during the first few years of the life cycle. Applications outside government, by contrast, experience a gradual and steady increase in the introduction of new flaws as they age.

Eng went on to state: “As modern IT systems have evolved and become more complex, the taxonomy of application flaws has become more varied.

“As such, the use of multiple scan types to find and fix flaws has become a best practice.”

He continued: “The public sector has come a long way in strengthening the security of applications that serve government, but there is still more work to be done for public sector entities to improve their cyber posture and repel incoming threats. 

“By focusing security efforts on the root cause of most cyber breaches—the application layer—agencies can achieve necessary improvements. Scanning regularly with a variety of testing types and addressing security debt—the accumulated software vulnerabilities that threaten a system’s safety—will pave the way toward a more secure future for government agencies.”

The full public sector research from the Veracode State of Software Security report is available here.

Share

Featured Articles

Dell SVP Forecasts AI PC Surge as Data Centre Demands Shift

Dell Technologies UK head Steve Young predicts widespread enterprise adoption of AI hardware in 2025, with data centres facing infrastructure overhaul

Apple Announces Latest Saudi Arabia Tech Sector Expansion

Apple plans retail locations in Saudi Arabia and increases developer training programmes as part of strategy to strengthen Middle East tech sector

SAP: AI & Data Key to Closing COP29 Climate Commitments Gap

SAP’s CSCO Sophia Mendelsohn on how AI and data collection could help companies meet climate targets set at COP29 conference in Azerbaijan

PwC and AWS Forge Path for Regulated AI Adoption

AI & Machine Learning

Nvidia Predictions: AI Infrastructure Set to Shift in 2025

AI & Machine Learning

Nvidia & AWS’s AI Breakthroughs at Re:Invent 2024

AI & Machine Learning