JFrog announced a new machine learning (ML) lifecycle integration between JFrog Artifactory and MLflow, an open source software platform originally developed by Databricks.
Retail may never be the same as it was pre-COVID and the pace of digital transformation keeps pushing faster. Worldwide online retail sales grew by more than 27 percent in 2020, and retailers "will likely ramp up their digital offerings as consumer shopping habits continue to lean in favor of ecommerce. An estimated 40% of consumers say they plan to shop in-store either the same amount or less after being vaccinated."
Because of the major uptick in volume in ecommerce, retailers' digital presence needs to be responsive and secure. Web applications need to meet customer demands for speed and a simple interface, but with 43% of all breaches occurring as a result of a vulnerable application layer, the security of these applications is critical.
Application security insights will be valuable and relevant for retailers on account of the growth of e-commerce and the revenue it is driving.
Veracode's recent State of Software Security report (SoSS) highlighted the frequency of vulnerabilities in applications across different industry verticals, including the retail and hospitality sector.
The report found that:
■ 26% of retail applications have high-severity security flaws
■ 76% of retail applications have flaws
■ 74% of total retail flaws are being fixed
To understand the context of this data, it's helpful to draw a comparison between how well retail and other industries secure applications and protect customers. The frequency of flawed retail applications is high, with more than three out of every four (76% to be exact) applications containing at least one flaw. Fortunately, regardless of this high volume of vulnerabilities, the retail industry's rate of fixing at 74% is second only to the financial services industry at 75%, and has a better rate than healthcare, manufacturing, technology and government verticals.
Retail, in addition to success in fix rate, has the best flaw-remediation speed, with the average application taking 125 days to fix half of its known defects. This means although the retail and hospitality sector begins with more flaws than some other industries, developers are relatively faster to recognize them, buckle down, and fix the flaws in an effort to improve the application's security and protect customer data.
In looking at this data, it's clear to see the promise of the retail industry's overall effectiveness in vulnerability detection and fixing, but it begs the question: What does all of this mean for retail amidst the ongoing COVID-19 pandemic? We have to understand there has been a new normal created for business and that normal is centered around e-commerce, which heavily drives up traffic across various applications.
An important figure to note from the SoSS report is that 55% of severe retail and hospitality flaws can be grouped into information leakage. If information leakage is exploited, it will deteriorate the consumer to business relationship. In addition, an exploitation of this type would heavily damage a company's brand and reputation.
Simply put, as online traffic, users, and applications increase, retail applications security must improve alongside it. Retail organizations must take on the responsibility of integrating security throughout the software development lifecycle, running security checks on their applications frequently, and using multiple types of scans, through both static and dynamic analysis, to identify defects. Following information leakage, the next top three flaw types are CRLF injection, cryptographic issues, and code quality. These flaws can be mitigated by implementing some sort of education program to build stronger, more secure code for retail applications.
Ultimately, every application will contain security defects, but to combat the unavoidable, developers and security teams should always strive to improve their ability to find and fix security issues with speed.
One way to achieve the goal of faster remediation speed and applications with fewer flaws involves educating the developers who build and deploy the applications on avoiding common security flaws and writing secure base code. This foundation will, in turn, make it much easier to fix flaws over time and increase remediation speed. From there, AppSec programs in retail organizations will be better prepared to handle faster release cycles without slowing down developers.
Industry News
Copado announced the general availability of Test Copilot, the AI-powered test creation assistant.
SmartBear has added no-code test automation powered by GenAI to its Zephyr Scale, the solution that delivers scalable, performant test management inside Jira.
Opsera announced that two new patents have been issued for its Unified DevOps Platform, now totaling nine patents issued for the cloud-native DevOps Platform.
mabl announced the addition of mobile application testing to its platform.
Spectro Cloud announced the achievement of a new Amazon Web Services (AWS) Competency designation.
GitLab announced the general availability of GitLab Duo Chat.
SmartBear announced a new version of its API design and documentation tool, SwaggerHub, integrating Stoplight’s API open source tools.
Red Hat announced updates to Red Hat Trusted Software Supply Chain.
Tricentis announced the latest update to the company’s AI offerings with the launch of Tricentis Copilot, a suite of solutions leveraging generative AI to enhance productivity throughout the entire testing lifecycle.
CIQ launched fully supported, upstream stable kernels for Rocky Linux via the CIQ Enterprise Linux Platform, providing enhanced performance, hardware compatibility and security.
Redgate launched an enterprise version of its database monitoring tool, providing a range of new features to address the challenges of scale and complexity faced by larger organizations.
Snyk announced the expansion of its current partnership with Google Cloud to advance secure code generated by Google Cloud’s generative-AI-powered collaborator service, Gemini Code Assist.
Kong announced the commercial availability of Kong Konnect Dedicated Cloud Gateways on Amazon Web Services (AWS).
Pegasystems announced the general availability of Pega Infinity ’24.1™.