Veracode Research Reveals Government Applications at Heightened Risk of Cyber Attack: 59% Have Flaws Left Unfixed for More than a Year
May 2024 by Veracode
Veracode released research revealing applications developed by public sector organisations have more security debt than those created by the private sector. Security debt, defined for this report as flaws that remain unfixed for longer than a year, exists in 59 percent of applications in the public sector, compared to the overall rate of 42 percent. The research analysed public sector organisations in more than 25 countries across the globe.
“Decades of accumulated security debt in unpatched software and poor security configurations, are in the applications that serve our government,” said Chris Eng, Chief Research Officer at Veracode. “Without a systematic and continuous approach to finding and fixing security flaws, the public sector is left dangerously exposed to attacks from hackers.”
UK government systems are increasingly under cyberattack, as malicious criminals target public sector organisations with more damaging and disruptive techniques. In response, the UK government is enforcing a flurry of initiatives to strengthen cybersecurity, including efforts to reduce risk in the applications that serve the government. For example, the Government’s National Cyber Strategy outlines comprehensive measures to enhance cybersecurity resilience, with objectives that emphasise the importance of secure software development. There is also a Code of Practice for Software Developers currently in development, which will ensure that organisations selling software to UK government agencies will prioritise security and resilience in the design of their products.
Veracode researchers found that while slightly fewer public sector organisations (68 percent) have security debt than other industries (71 percent), they tend to accumulate more of it. Only three percent of applications are flaw-free, compared to six percent across other industries. Even more concerning, 40 percent of public sector entities have persistent, high-severity flaws that constitute ‘critical’ security debt, which would put the confidentiality, integrity, and availability of businesses at serious risk if exploited.
“The good news is that most organisations have the capacity to remediate all critical debt, but risk prioritisation is key,” said Eng. “Two-thirds of all flaws in public sector organisations are either less than one year old or are not critical in severity. In addition, less than one percent of all flaws constitute critical security debt. By prioritising that security debt with focused effort, organisations can achieve maximum risk reduction and then move to address non-critical flaws based on their risk tolerance and capabilities.”
According to the report, security debt in the public sector primarily affects first-party code (93 percent), but most of the critical security debt comes from third-party dependencies (55.5 percent). This reinforces the importance of the UK Government Digital Service (GDS) Open Standards Principles, which aim to ensure that open-source software used in the public sector is secure and sustainable. It also emphasises the need for organisations to focus on both first- and third-party code to effectively reduce security debt.
The analysis further shows security debt in the public sector is primarily concentrated in older, larger applications (22 percent). This is especially true for critical security debt (30 percent), confirming a correlation between application age and the accumulation of security debt. Researchers also compared the security debt profile for different development languages and found that Java and .NET applications stand out as significant sources of debt in the public sector.
“The current state of software security in the public sector reinforces the importance of making secure by design a standard approach for the whole network connected world,” closed Chris Eng. “Our goal with this research is to further support government and industry partners in promoting widespread adoption of these principles.”