@stake published its first application security metrics report in April 2002. It is an analyis of 45 "e-business" applications that @stake assessed for its clients. Most are web applications.
The Security of Applications: Not All Are Created Equal http://www.atstake.com/research/reports/acrobat/atstake_app_unequal.pdf @stake found that 70% of the defects analyzed were design flaws that could have been found using threat modelling and secure design reviews before the implementation stage of development. 62% of the apps allowed access controls to be bypassed 27% had no prevention of brute force attacks against passwords 71% had poor input validation @stake lists the top 10 categories of application defects found. The list predates the OWASP Top 10 by eleven months and is largely the same. The data has percentage of applications effected and is ranked, so it is not anecdotal. The is a follow-up of the first application defect study done 15 months later in July, 2003. This was done to see if application security is improving. The Security of Applications, Reloaded http://www.atstake.com/research/reports/acrobat/atstake_app_reloaded.pdf The results found that security is improving overall but that there is a widening gap between the security quality of the top quartile of applications and the bottom quartile. There is another article that 3 @stake authors wrote for IEEE Security and Privacy Magazine which contains elements from both reports. Information Security: Why the Future Belongs to the Quants http://www.atstake.com/research/reports/acrobat/ieee_quant.pdf Cheers, Chris On Wed, 3 Mar 2004, Kenneth R. van Wyk wrote: > Hi all, > > I'm looking for published reports on software vulnerabilities with regard to > the software development process. With a bit of googling, I've found some > good starting points (e.g., www.securitytracker.com/ > learn/securitytracker-stats-2002.pdf), that provide stats on vulnerabilities > by type. I'm particularly interested in stats that provide insight into > where in the software development process the vulnerabilities were > introduced. > > Anyone have some good citations to share? > > Cheers, > > Ken van Wyk > -- > KRvW Associates, LLC > http://www.KRvW.com > > >
