DEVOPSdigest

Companies are struggling to keep up with rapidly evolving threats and the need to automate security efforts. Attacks against web applications have increased in prevalence to become the single biggest cause of data breaches. As the battlefield shifts more and more from the network to the application, it is important to understand how companies are meeting this challenge.

Verizon's 2020 Data Breach Investigation Report found that 43% of breaches could be traced back to attacks against web applications — more than double the results from last year. Equifax is a high-profile example of a web application data breach that exposed the personal information of 147 million people, costing the company $1.38 billion in settlements and security upgrades.

According to Web Application Security — Enterprises are Losing the War, a report prepared by Acunetix and Dimensional Research, 88% of companies now develop web applications in-house.

Half of the respondents have been successful with their shift-left efforts and include web application security scans with every code build or during unit testing. However, that leaves half that don't scan early enough and may incur major time and resource costs to remediate vulnerabilities. Remarkably, half of the respondents said that vulnerabilities are found faster than they can be fixed, meaning their web applications are open to an attack.

"Companies have moved quickly into building their own software, including customer-facing software that contains sensitive data, but have struggled with the challenge of securing those applications," said Mark Ralls, President and CEO of Acunetix.

Nearly 64% of enterprises still burden specialized security personnel with simple web application security testing that could be automated. And less than half of companies empower developers to run security scans on their own code.

"While companies are definitely making the effort to secure their web applications, with half of companies scanning at each code build and 80% scanning all web applications, 36% of the respondents reported using security testing tools that are inadequate for the job," said Ralls. "It's not enough to check the box on web application security, companies need high-quality dynamic security testing solutions to effectively protect themselves and their customers."

Methodology: Security, DevOps, and C-suite professionals from 382 organizations across the globe participated in the survey.