Feeds

Security flaws on the rise, questions remain

Flawed rationale

5 things you didn’t know about cloud backup

Yet, while the data is significantly flawed, the original story told by US-CERT's list seems to be the right one. The number of vulnerabilities reported in 2005 increased, mainly due to researchers looking into the security of Web applications. The National Vulnerability Database noted the largest increase of 96 percent from 2004 to 2005, while the Symantec Vulnerability Database saw the smallest increase of 40 percent.

While publicly reported flaws jumped, that does not necessarily mean dire prospects for home users' or businesses' security, said David Ahmad, manager for development at Symantec's Security Response team.

"Web-based vulnerabilities are all over the place and they are really easy to find--they are the low-hanging fruit," Ahmad said." We have had high-profile vulnerabilities, but that is not what is driving this increase."

Finding those flaws does not require much skills, said Brian Martin, content manager for the OSVDB.

"We are seeing people discover vulnerabilities in software with tiny distribution and low installed base--free guestbooks that are written left and right, available by the thousands," he said. "And we are seeing that it takes no skill to find vulnerabilities in these applications."

Disparate data

The number of vulnerabilities entered into four major databases vary widely over the past five years, but seem to indicate that 2005 was a banner year for bugs.

  2005 2004 2003 2002 2001
CERT/CC 5,990 3,780 3,784 4,129 2,437
NVD 4,584 2,340 1,248 1,943 1,672
OSVDB 7,187 4,629 2,632 2,184 1,656
Symantec 3,766 2,691 2,676 2,604 1,472

Sources: Computer Emergency Response Team Coordination Center (CERT/CC), National Vulnerability Database, Open-Source Vulnerability Database, and the Symantec Vulnerability Database.

Yet, the entire focus should not be on the rash of Web application flaws, Mell said.

The computer scientist conducted an informal survey of entries for flaws in products from well-known companies and found that six of 14 software makers had seen a doubling in the number of vulnerability reports, while another four firms saw a decrease in the number of reports. The remaining four companies reported a similar number of flaws as the year before.

"I find it amazing that large and reputable software companies are seeing a large number more flaws this year (2005) than last year," Mell said.

The database managers also cautioned that the vulnerability counts for any particular year generally do not reflect the state of secure software development, only where the research community's interests lie.

"These numbers are showing the state of practice from a few years ago, rather than what the current state of practice is today," said Jeff Havrilla, team leader of vulnerability analysis at the CERT Coordination Center.

Making the issue more difficult, several software vendors move to release patches on a specific day has resulted in most security bulletins detailing multiple vulnerabilities, a situation that makes the true number of flaws harder to count, Havrilla said.

This article was originally published at SecurityFocus.

Secure remote control for conventional and virtual desktops

More from The Register

next story
Ice cream headache as black hat hacks sack Dairy Queen
I scream, you scream, we all scream 'DATA BREACH'!
Goog says patch⁵⁰ your Chrome
64-bit browser loads cat vids FIFTEEN PERCENT faster!
NIST to sysadmins: clean up your SSH mess
Too many keys, too badly managed
JLaw, Kate Upton exposed in celeb nude pics hack
100 women victimised as Apple iCloud accounts reportedly popped
Scratched PC-dispatch patch patched, hatched in batch rematch
Windows security update fixed after triggering blue screens (and screams) of death
Researchers camouflage haxxor traps with fake application traffic
Honeypots sweetened to resemble actual workloads, complete with 'secure' logins
Attack flogged through shiny-clicky social media buttons
66,000 users popped by malicious Flash fudging add-on
New Snowden leak: How NSA shared 850-billion-plus metadata records
'Federated search' spaffed info all over Five Eyes chums
Three quarters of South Korea popped in online gaming raids
Records used to plunder game items, sold off to low lifes
Oz fed police in PDF redaction SNAFU
Give us your metadata, we'll publish your data
prev story

Whitepapers

Endpoint data privacy in the cloud is easier than you think
Innovations in encryption and storage resolve issues of data privacy and key requirements for companies to look for in a solution.
Implementing global e-invoicing with guaranteed legal certainty
Explaining the role local tax compliance plays in successful supply chain management and e-business and how leading global brands are addressing this.
Advanced data protection for your virtualized environments
Find a natural fit for optimizing protection for the often resource-constrained data protection process found in virtual environments.
Boost IT visibility and business value
How building a great service catalog relieves pressure points and demonstrates the value of IT service management.
Next gen security for virtualised datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.