Business Wire

Veracode Research Reveals Government Applications at Heightened Risk of Cyber Attack: 59% Have Flaws Left Unfixed for More than a Year

Share

Veracode, a global leader in application risk management, today released research revealing applications developed by public sector organizations have more security debt than those created by the private sector. Security debt, defined for this report as flaws that remain unfixed for longer than a year, exists in 59 percent of applications in the public sector, compared to the overall rate of 42 percent. The research analyzed public sector organizations in more than 25 countries across the globe.

This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20240529282258/en/

To view this piece of content from mms.businesswire.com, please give your consent at the top of this page.

Figure 2: Security Debt in Public Sector Applications (Graphic: Business Wire)

“Decades of accumulated security debt in unpatched software and poor security configurations, are in the applications that serve our government,” said Chris Eng, Chief Research Officer at Veracode. “Without a systematic and continuous approach to finding and fixing security flaws, the public sector is left dangerously exposed to attacks from hackers.”

Federal government systems are increasingly under cyberattack, as malicious criminals target public sector organizations with more damaging and disruptive techniques. In response, the federal government is enforcing a flurry of initiatives to strengthen cybersecurity, including efforts to reduce risk in the applications that serve the government. In March of 2024, the Cybersecurity and Infrastructure Security Agency (CISA) and the Office of Management and Budget (OMB) released the Secure Software Development Attestation Form to hold providers to the federal government accountable for insecure software.

Veracode researchers found that while slightly fewer public sector organizations (68 percent) have security debt than other industries (71 percent), they tend to accumulate more of it. Only three percent of applications are flaw-free, compared to six percent across other industries. Even more concerning, 40 percent of public sector entities have persistent, high-severity flaws that constitute ‘critical’ security debt, which would put the confidentiality, integrity, and availability of businesses at serious risk if exploited.

“The good news is that most organizations have the capacity to remediate all critical debt, but risk prioritization is key,” said Eng. “Two-thirds of all flaws in public sector organizations are either less than one year old or are not critical in severity. In addition, less than one percent of all flaws constitute critical security debt. By prioritizing that security debt with focused effort, organizations can achieve maximum risk reduction and then move to address non-critical flaws based on their risk tolerance and capabilities.”

According to the report, security debt in the public sector primarily affects first-party code (93 percent), but most of the critical security debt comes from third-party dependencies (55.5 percent). This reinforces the importance of the Open Source Security Software Initiative (OS3I), an inter-agency working group focused on ensuring open-source software is “as safe, secure and sustainable as it is open.” It also emphasizes the need for organizations to focus on both first- and third-party code to effectively reduce security debt.

The analysis further shows security debt in the public sector is primarily concentrated in older, larger applications (22 percent). This is especially true for critical security debt (30 percent), confirming a correlation between application age and the accumulation of security debt. Researchers also compared the security debt profile for different development languages and found that Java and .NET applications stand out as significant sources of debt in the public sector.

“The current state of software security in the public sector reinforces the importance of making secure by design a standard approach for the whole network connected world,” closed Eng. “We applaud CISA’s recent announcement of its Secure by Design Pledge and are proud to be one of the inaugural signatories. Our goal with this research is to further support our government and industry partners in promoting widespread adoption of these principles.”

The full State of Software Security Public Sector 2024 report is available to download on the Veracode website.

About the State of Software Security Report

The Veracode State of Software Security 2024 report analyzed data from large and small companies, commercial software suppliers, software outsourcers, and open-source projects. The research draws from more than a million (1,007,133) applications across all scan types, 1,553,022 dynamic analysis scans, and 11,429,365 static analysis scans. All those scans produced 96 million raw static findings, 4 million raw dynamic findings, and 12.2 million raw software composition analysis findings.

About Veracode

Veracode is a global leader in Application Risk Management for the AI era. Powered by trillions of lines of code scans and a proprietary AI-assisted remediation engine, the Veracode platform is trusted by organizations worldwide to build and maintain secure software from code creation to cloud deployment. Thousands of the world’s leading development and security teams use Veracode every second of every day to get accurate, actionable visibility of exploitable risk, achieve real-time vulnerability remediation, and reduce their security debt at scale. Veracode is a multi-award-winning company offering capabilities to secure the entire software development life cycle, including Veracode Fix, Static Analysis, Dynamic Analysis, Software Composition Analysis, Container Security, Application Security Posture Management, and Penetration Testing.

Learn more at www.veracode.com, on the Veracode blog, and on LinkedIn and X.

Copyright © 2024 Veracode, Inc. All rights reserved. Veracode is a registered trademark of Veracode, Inc. in the United States and may be registered in certain other jurisdictions. All other product names, brands or logos belong to their respective holders. All other trademarks cited herein are property of their respective owners.

To view this piece of content from cts.businesswire.com, please give your consent at the top of this page.

Contact information

For more information, please contact:
Katy Gwilliam
kgwilliam@veracode.com

About Business Wire

For more than 50 years, Business Wire has been the global leader in press release distribution and regulatory disclosure.

Subscribe to releases from Business Wire

Subscribe to all the latest releases from Business Wire by registering your e-mail address below. You can unsubscribe at any time.

Latest releases from Business Wire

SES Announces Successful Syndication and Raising of €3 Billion Acquisition Financing19.6.2024 12:59:00 EEST | Press release

SES S.A. announces the successful syndication of a €3 billion equivalent acquisition financing package to support the earlier announced agreement for SES to acquire Intelsat S.A.. Prior to the Intelsat deal announcement, Deutsche Bank AG and Morgan Stanley jointly had underwritten a €3 billion bridge facility to support SES’s financing requirements as part of the agreement to acquire Intelsat. This €3 billion bridge facility has been successfully syndicated now, with a highly oversubscribed level of commitments, to an international group of existing relationship and new banks in the form of a €2.1 billion bridge facility and US$1 billion term loan. The term loan was upsized in syndication on the back of a strong response from the bank group. The bridge facility serves to provide financing certainty and flexibility in the issuance of bonds. The bridge facility has tenor of 12 months and is extendable twice by a further six months while the term loan has a five-year amortising tenor from

Tecnotree Announces Strategic Partnership with HCLTech to Bring Advanced 5G-Led GenAI Solutions for Global Telcos19.6.2024 12:42:00 EEST | Press release

Tecnotree, a global digital platform and services leader for AI, 5G, and cloud-native technologies, today announced a strategic partnership with HCLTech, a leading global technology company, to co-develop advanced 5G-led generative AI (GenAI) solutions for the telecom industry. This press release features multimedia. View the full release here: https://www.businesswire.com/news/home/20240619554988/en/ Tecnotree Announces Strategic Partnership with HCLTech to Bring Advanced 5G-Led GenAI Solutions for Global Telcos (Graphic: Business Wire) This partnership combines Tecnotree’s proven 5G and AI-led BSS platform capabilities and HCLTech’s deep expertise in driving digital transformation for telcos and CSPs. Together, the companies will deliver solutions designed to redefine digital experiences through the integration of Digital BSS and Tecnotree Sensa AIML fabric, leading to comprehensive business transformation. The solutions will enable customers to enhance business agility and faster re

LatticeFlow AI Announces Key Innovation to Accelerate Development of Deepfake Detection Software in Advance of U.S. Elections19.6.2024 11:34:00 EEST | Press release

LatticeFlow AI, the leading platform for building trustworthy AI applications, announces LatticeFlow AI Audio, the first product designed to find and identify model errors in audio AI applications. This release addresses the pressing demand for reliable voice deepfake detection solutions in advance of the 2024 U.S. elections. In this context, LatticeFlow AI Audio, combined with the company’s existing capabilities in computer vision, makes it the most advanced solution for deepfake detectors to combat deepfake threats combining audio and video. “We believe that there is no place for deepfakes in civil, ethical societies,” said Dr. Petar Tsankov, Co-founder and CEO at LatticeFlow AI. “Ethical, safe, and trustworthy AI are the foundational values of our company – and why we want to help address deepfakes detection in advance of the 2024 elections. LatticeFlow AI Audio is the industry’s only product that can automatically find and identify AI audio data and model errors, enabling our clien

The NAGA Group AG: 2024 Capital Markets Day – Save the Date19.6.2024 10:56:00 EEST | Press release

The NAGA Group AG (XETRA: N4G, ISIN: DE000A161NR7), provider of the All-in-One Financial SuperApp NAGA, cordially invites analysts, investors, shareholders as well as media and partners to virtually join its Capital Markets Day on 11 July 2024, 16.00 CEST. The 2024 Capital Markets Day will provide valuable insights into the strategic vision and growth ambitions of the NAGA Group. Octavian Patrascu, the newly appointed CEO of the NAGA Group, will host the Virtual 2024 Capital Markets Day and elaborate on the Company's latest achievements, its plans for the future, and the innovative path the Group is forging. KEY TOPICS Company Performance: H1 2024 financial results and milestones Merger with CAPEX.com: Strategic rationale, designed to enhance financial efficiency and market presence Innovation and Technology: CEO Octavian Patrascu on his vision for the Group, including the rollout of the NAGA SuperApp Future Plans: Upgrades to NAGA’s app and ecosystem, focusing on user experience, AI i

Ukko-Pekka Nieminen Launches CPFMedia.net to Revolutionize SEO for iGaming Companies19.6.2024 10:40:00 EEST | Press release

CPF Media, a new digital marketing agency specializing in SEO for the iGaming industry, has officially launched its website, CPFMedia.net. Founded by Ukko-Pekka Nieminen, the agency combines a decade of iGaming expertise with cutting-edge SEO and digital media strategies to offer unparalleled services to clients worldwide. About CPF Media CPF Media is rooted in the dynamic landscape of Malta, with foundational ties to Finland. This unique blend of cultural insights and extensive experience in various MGA casinos positions CPF Media as a leader in delivering measurable results and innovative digital solutions. “Our mission at CPF Media is to provide comprehensive digital solutions that elevate our clients’ online presence and drive meaningful engagement with their audience,” says Ukko-Pekka Nieminen, founder of CPF Media. “With our specialized knowledge in the iGaming sector, we are equipped to offer tailored strategies that ensure our clients stay ahead in this competitive market.” Our

In our pressroom you can read all our latest releases, find our press contacts, images, documents and other relevant information about us.

Visit our pressroom
HiddenA line styled icon from Orion Icon Library.Eye