Study: Largest vendors account for fewer software flaws

By Jaikumar Vijayan, Computerworld, 07/25/07

 Start a discussion    Print article

 Comments (1)    Print article

Though it might not seem that way, the top 10 most vulnerable software vendors - and, yes, that includes Microsoft - are contributing a smaller percentage of all vulnerability disclosures per year compared to five years ago.

That's according to an analysis by Gunter Ollmann, director of security strategies at IBM's Internet Security Systems X-Force team.

Ollmann, who crunched vulnerability data gathered by X-Force between 2002 and 2006, said the overall percentage of security flaws disclosed by the most vulnerable software vendors dropped from 20.2% in 2002 to 14.6% during that period.

Much of that decrease is likely the result of improved quality assurance and testing processes by the most vulnerable software vendors, Ollmann said. Most of their software packages have been through multiple versions and have been combed thoroughly for vulnerabilities by security researchers, Ollmann said.

According to Ollmann, the most vulnerable vendors typically have also been the biggest software vendors and those with the largest installed bases. Traditionally, security researchers and hackers have gone after vendors with the biggest installed bases because that is where they can have the biggest impact.

As larger vendors begin to do a better job of locking down their software, hackers and software researchers have begun focusing their attention on newer vendors and their applications, which has resulted in an overall increase in the number of vulnerabilities being reported, Ollmann said.

In the past five years, the list of the most vulnerable vendors has consistently included Microsoft, Cisco, IBM, Sun and the Linux Kernel Organization, Ollmann said. Others on the list for 2006 were Oracle, Apple, Mozilla and Adobe.

Together, these vendors accounted for 964 vulnerabilities in 2006, or roughly 14% of the total disclosed by all vendors. The remaining 85% or more were accounted for by smaller vendors. For instance, nearly 1,000 vulnerabilities were reported by relatively small vendors of PHP applications, he said.

For more enterprise computing news, visit Computerworld. Story copyright Computerworld, Inc.

Invalid query - session: Can't connect to local MySQL server through socket '/tmp/mysql.sock' (2)

About Us | Contact Us | Advertising Info | Terms of Service/Privacy

Copyright, 2006-2007 Network World, Inc. All rights reserved.