Cybersecurity Researcher, Entrepreneur, Professor. Follow me for FUD-free, data-filled analysis of infosec trends and challenges.
What does security debt (old, unresolved flaws in code) look like across applications in your organization? Perhaps similar to one of these 20 anonymous organizations we sampled during a recent analysis of #appsec scan data. Each rectangle represents a different organization, which is subdivided into sections corresponding to the size of its active applications. The color applied to those applications measures their density of security debt. You can think of this as a depiction of the shape and status of the application attack surface for each organization. Organization 4 is relatively clear of debt across most of its applications, with a few exceptions in the lower right corner. Organization 9 below it shows pretty much the opposite trend—one tiny debt-free application floats alone in a sea of debt. Other organizations in this sample exhibit a relatively even distribution of debt across applications (e.g., Org 14) to an application attack surface that runs the gamut of debt density (e.g., Org 6). So, what makes one organization look so different from another when it comes to the distribution of security debt across their applications? Is it possible for teams to reverse indebtedness for the applications they develop and manage? Download the full report from Veracode, with analysis by Cyentia Institute, to find out! Get is here: https://lnkd.in/evh5jm2Z #softwaresecurity #applicationsecurity #devsecops #devops
