Synopsys has published the 2023 Software Vulnerability Snapshot report.
According to the data, analysed by Synopsys Cybersecurity Research Centre (CyRC), there has been a decrease in vulnerabilities found in target applications, from 97 per cent in 2020 to 83 per cent in 2022, a sign that code reviews, automated testing, and continuous integration are helping to reduce common programming errors.
The report details three years of data (2020 - 2022) derived from tests run by Synopsys Security Testing Services, with targets made up of web applications, mobile applications, network systems, and source code. Tests are designed to probe running applications as a real-world attacker would, incorporating multiple security testing techniques including penetration (pen) testing, dynamic application security testing (DAST), mobile application security testing (MAST), and network security testing.
Although this is a positive development for the industry, the data also demonstrates that relying on a single security testing solution such as static application security testing (SAST) is no longer sufficient as an approach. For example, server misconfigurations represented an average of 18 per cent of the total vulnerabilities found in the three years of tests. Without a multi-layered security approach that combines SAST to identify coding flaws, DAST to examine running applications, SCA to identify vulnerabilities introduced by third-party components, and penetration testing to identify issues that might have been missed by internal testing, these types of vulnerabilities will likely go unchecked.
Jason Schmitt, General Manager of the Synopsys Software Integrity Group said, "for the first time in years, we’re seeing a decrease in the number of known vulnerabilities in software, which provides new hope that organisations are taking security seriously and prioritizing a strategic and holistic approach to software security in order to make a lasting impact. As hackers have become more sophisticated, a multi-layered security approach is needed more than ever to identify where software risks live and protect businesses from being exploited.”
Additional findings include