While one might anticipate that the more complex an application is, the more likely it is to have security vulnerabilities, a recent analysis from Black Duck found the opposite to be true.
Its 2024 Software Vulnerability Snapshot report analyzed data from 200,000 dynamic application security testing scans for 1,300 applications across 19 different industry sectors.
The report categorizes small complexity apps as those with minimal interactivity and a simple crawl tree, while higher complexity apps are those that have many interactive elements and dynamically generated content.
The results show that small and medium complexity applications were more likely to have critical vulnerabilities than larger complexity ones. 2,039 vulnerabilities were found in small complexity apps, 1,679 were found in medium complexity apps, and 505 were found in large complexity apps.
“This metric suggests that many organizations are underestimating the security needs of sites containing fewer complex applications,” Black Duck wrote in a blog post about the report.
Some of the most high-risk industry sectors were the ones that suffered from the most critical vulnerabilities. Finance and insurance had 1,299 critical vulnerabilities, healthcare and social assistance had 992, and information services had 446. Agriculture, mining/quarrying and oil/gas extraction, construction, and waste management were among those with little to no vulnerabilities.
However, despite the larger prevalence of vulnerabilities, finance and insurance companies also have very fast response times compared to other sectors, with it taking 28 days to close critical vulnerabilities for small complexity apps, 53 days for medium complexity apps, and 78 days for larger complexity apps.
Healthcare and social assistance companies were actually able to close critical vulnerabilities faster for larger complexity apps than smaller ones. It took them 87 days to close critical vulnerabilities on small complexity apps and only 20 days for larger complexity apps.
Utilities and educational services had significantly slower response times. It takes utilities companies 107 days to resolve vulnerabilities for small complexity apps and 876 days for medium complexity apps. In education, it takes an average of 342 days for small complexity apps and 111 days for medium complexity apps.
“These variations highlight the impact of resource allocation and regulatory pressures on security initiatives across different sectors,” Black Duck wrote.
Black Duck also found that of the 96,917 vulnerabilities it analyzed, the most common were cryptographic failures, injection vulnerabilities, and security misconfigurations.
There were 30,726 vulnerabilities that were categorized as cryptographic failures, 4,882 of which were deemed critical-risk instances. This type of vulnerability affected 86% of companies surveyed.
Injection vulnerabilities, which include SQL injection and cross-site scripting, were responsible for 4,814 vulnerabilities. Over half of them (2,491) were considered to be critical instances.
Security misconfigurations were responsible for 36,000 vulnerabilities, and while most were categorized as “informational” and requiring no immediate action, they can still represent potential risks, Black Duck explained. This type of vulnerability affected 98% of companies analyzed.
“The high number of vulnerabilities found from the past year is a clear wake-up call that businesses cannot remain stagnant when deploying new security measures,” said Jason Schmitt, CEO of Black Duck. “The longer it takes for an organization to patch a vulnerability, the larger the chance of exploitation. Software risk equates to business risk, and with today’s malicious actors being more sophisticated than ever, it’s increasingly important that businesses across every sector build trust in their software by implementing a comprehensive and integrated approach.”