Feeds

Critical bugs surge in reduced flaw haul

Less is more scary

Top three mobile application threats

The number of software vulnerabilities discovered last year dropped last year after several years of growth.

But although the absolute number of software bugs unearthed last year slipped by 5.4 per cent compared to 2006, the number of high-priority vulnerabilities increased by 28 per cent, according to a preliminary analysis of bugs by the X-Force group in IBM's ISS security division. By comparison, the volume of vulnerabilities discovered in the previous two years increased by 41 per cent year-on-year.

"2005 and 2006 saw large spikes in vulnerability growth (approximately 41 per cent each year) that were well above the X-Force Database historical average (27 per cent a year). The drop [in 2007] could represent an anomaly, a statistical correction or a new trend in the amount of disclosures," X-Force researchers note.

X-Force researchers reckon the increased percentage of high-impact vulns among the smaller sample may be due to researchers focusing on finding more difficult, high-priority bugs.

Although X-Force's findings are open to different interpretations they do fall in line with findings from Microsoft published last October, looking at the first half of 2007. The software giant noted a drop in the number of vulnerabilities in the first half of 2007 along with a rise in the prevalence of critical flaws among that reduced number. Microsoft's analysis - based on data from the National Vulnerability Database - found a five per cent drop in vulnerability numbers in 1H07 to around 3,600 bugs for the first six months of last year. ®

Combat fraud and increase customer satisfaction

More from The Register

next story
Obama allows NSA to exploit 0-days: report
If the spooks say they need it, they get it
Heartbleed exploit, inoculation, both released
File under 'this is going to hurt you more than it hurts me'
Canadian taxman says hundreds pierced by Heartbleed SSL skewer
900 social insurance numbers nicked, says revenue watchman
German space centre endures cyber attack
Chinese code retrieved but NSA hack not ruled out
Burnt out on patches this month? Oracle's got 104 MORE fixes for you
Mass patch for issues across its software catalog
Reddit users discover iOS malware threat
'Unflod Baby Panda' looks to snatch Apple IDs
Oracle working on at least 13 Heartbleed fixes
Big Red's cloud is safe and Oracle Linux 6 has been patched, but Java has some issues
prev story

Whitepapers

Mainstay ROI - Does application security pay?
In this whitepaper learn how you and your enterprise might benefit from better software security.
Combat fraud and increase customer satisfaction
Based on their experience using HP ArcSight Enterprise Security Manager for IT security operations, Finansbank moved to HP ArcSight ESM for fraud management.
The benefits of software based PBX
Why you should break free from your proprietary PBX and how to leverage your existing server hardware.
Top three mobile application threats
Learn about three of the top mobile application security threats facing businesses today and recommendations on how to mitigate the risk.
3 Big data security analytics techniques
Applying these Big Data security analytics techniques can help you make your business safer by detecting attacks early, before significant damage is done.