Study: Largest vendors account for fewer software flaws
Improved quality assurance, testing likely reasons for improvement
Though it might not seem that way, the top 10 most vulnerable software vendors -- and, yes, that includes Microsoft Corp. -- are contributing a smaller percentage of all vulnerability disclosures per year compared with five years ago.
Ollmann, who crunched vulnerability data gathered by X-Force between 2002 and 2006, said the overall percentage of security flaws disclosed by the most vulnerable software vendors dropped from 20.2% in 2002 to 14.6% during that period.
Much of that decrease is likely the result of improved quality assurance and testing processes by the most vulnerable software vendors, Ollmann said. Most of their software packages have been through multiple versions and have been combed thoroughly for vulnerabilities by security researchers, he said.
According to Ollmann, the most vulnerable vendors typically have also been the biggest software vendors and those with the largest installed bases. Traditionally, security researchers and hackers have gone after vendors with the biggest installed bases because that is where they can have the biggest impact.
As larger vendors begin to do a better job of locking down their software, hackers and software researchers have begun focusing their attention on newer vendors and their applications, which has resulted in an overall increase in the number of vulnerabilities being reported, Ollmann said.
In the past five years, the list of the most vulnerable vendors has consistently included Microsoft, Cisco Systems Inc., IBM, Sun Microsystems Inc. and the Linux Kernel Organization Inc., Ollmann said. Others on the list for 2006 were Oracle Corp., Apple Inc., Mozilla Corp. and Adobe Systems Inc.
Together, these vendors accounted for 964 vulnerabilities in 2006, or roughly 14% of the total disclosed by all vendors. The remaining 85% or more were accounted for by smaller vendors. For instance, nearly 1,000 vulnerabilities were reported by relatively small vendors of PHP applications, he said.
Ollmann acknowledged that the vulnerabilities reported by the top 10 are likely to have affected a far larger number of people than a majority of the flaws reported by smaller vendors. At the same time, it is also true that the larger vendors have been doing a better job in fixing reported flaws, he said.
Out of the top 10 vendors, only 14% of the publicly reported flaws remained unpatched in 2006, while 65% of all other publicly reported flaws remain unpatched.
Larger vendors are also more likely than smaller ones to have better mechanisms for detecting flaws and alerting customers, he added.
Read more about Security in Computerworld's Security Topic Center.
- Best iPhone, iPad Business Apps for 2014
- 14 Tech Conventions You Should Attend in 2014
- 10 Desktop Apps to Power Your Windows PC
- How to Add New Job Skills Without Going Back to School
- Slideshow: 7 security mistakes people make with their mobile device
- iOS vs. Android: Which is more secure?
- 11 sure signs you've been hacked
- The 12 PCI DSS 3.0 requirements addressed by Peer 1 Hosting This handy quick reference outlines the 12 PCI DSS 3.0 requirements, who needs to be compliant and how Alert Logic solutions address the...
- Defense Throughout the Vulnerability Life Cycle This whitepaper provides insight into how to leverage threat and log management technologies to protect your IT assets throughout their vulnerability life cycle.
- Mobile Policy Checklist Here's what to consider when putting together a mobile policy designed to support a highly productive workforce.
- Securing BYOD Mobile computing is becoming so ubiquitous that people no longer bat an eye seeing someone working two devices simultaneously. Individuals and organizations are...
- Live Webcast On-demand webinar: "Mobility Mayhem: Balancing BYOD with Enterprise Security" Check out this on-demand webinar to hear Sophos senior security expert John Shier deep dive into how BYOD impacts your enterprise security strategy...
- Live Webcast Endpoint Backup & Restore: Protect Everyone, Everywhere Arek Sokol from the bleeding-edge IT team at Genentech/Roche explains how he leverages cross-platform enterprise endpoint backup in the public cloud as part...
- Streamline Software Asset Management, Compose a software Management Symphony Keeping track of your organization's software is easy with effective software management solutions from CDW. View the videos in our software solutions channel
- Druva inSync: Endpoint Data Protection & Governance CLICK HERE to watch this video about protecting corporate data on laptops and mobile devices, sponsored by Druva. All Security White Papers | Webcasts