SECURITY INFLUENCERS BLOG

Security influencers provide real-world insight and “in-the-trenches” experiences on topics ranging from application security to DevOps and risk management

START FREE TRIAL

How Code Vulnerabilities Can Lead to Bad Accidents

Are you interested in the security of the open source libraries you're trusting with your business? If so, you may want to read this article, "How Code Vulnerabilities Can Lead to Bad Accidents" that was featured in Dark Reading. It discusses how the broken software supply chain leaves organizations open to hackers and why organizations need to know whether their applications are built using trustworthy "components." You will also learn how organizations can protect themselves against these software supply chain risks by deploying Runtime Application Security Protection (RASP) directly into their Web applications.

READ THE ARTICLE >>
How Code Vulnerabilities Can Lead to Bad Accidents

Below is an excerpt from the article "How Code Vulnerabilities
Can Lead to Bad Accidents featured in Darkreading.

The software supply chain is broken. To prevent hackers from exploiting vulnerabilities, organizations need to know where their applications are, and whether they are built using trustworthy components.

When a car manufacturer discovers a faulty part, it is obliged to issue a recall and notify its customers of the damaged product. The problem is that all these cars are already on the road driving around with a recalled part, causing immense amounts of liability for all parties involved.

Building a Web application or API with open source components has direct parallels to building a car. Anyone using open source components must be aware that there will be vulnerabilities. And whether you’re building a car or software, your product is only as good as the components you use. Frankly, cars these days are basically software on wheels, but our software supply chain is full of holes.

You may not realize that a modern Web application is built using hundreds of these components that usually include many millions of lines of code.

According to data from Contrast Security spanning almost 10,000 applications totaling over 8 billion lines of code, the average application is 79% library code, and only 21% custom code. Just over 76% of applications contain at least one vulnerability, and 34% containing four or more vulnerabilities. These are shocking failures of the software supply chain.

READ THE COMPLETE ARTICLE >>

 

 runtime-application-self-protection-rasp

Jeff Williams, Co-Founder, Chief Technology Officer

Jeff Williams, Co-Founder, Chief Technology Officer

Jeff brings more than 20 years of security leadership experience as co-founder and Chief Technology Officer of Contrast Security. He recently authored the DZone DevSecOps, IAST, and RASP refcards and speaks frequently at conferences including JavaOne (Java Rockstar), BlackHat, QCon, RSA, OWASP, Velocity, and PivotalOne. Jeff is also a founder and major contributor to OWASP, where he served as Global Chairman for 9 years, and created the OWASP Top 10, OWASP Enterprise Security API, OWASP Application Security Verification Standard, XSS Prevention Cheat Sheet, and many more popular open source projects. Jeff has a BA from Virginia, an MA from George Mason, and a JD from Georgetown.

SUBSCRIBE TO THE BLOG