DEVOPSdigest

Retail may never be the same as it was pre-COVID and the pace of digital transformation keeps pushing faster. Worldwide online retail sales grew by more than 27 percent(link is external) in 2020, and retailers "will likely ramp up(link is external) their digital offerings as consumer shopping habits continue to lean in favor of ecommerce. An estimated 40% of consumers say they plan to shop in-store either the same amount or less after being vaccinated."

Because of the major uptick in volume in ecommerce, retailers' digital presence needs to be responsive and secure. Web applications need to meet customer demands for speed and a simple interface, but with 43% of all breaches occurring as a result of a vulnerable application layer, the security of these applications is critical.

Application security insights will be valuable and relevant for retailers on account of the growth of e-commerce and the revenue it is driving.

Veracode's recent State of Software Security report (SoSS) highlighted the frequency of vulnerabilities in applications across different industry verticals, including the retail and hospitality sector.

The report found that:

■ 26% of retail applications have high-severity security flaws

■ 76% of retail applications have flaws

■ 74% of total retail flaws are being fixed

To understand the context of this data, it's helpful to draw a comparison between how well retail and other industries secure applications and protect customers. The frequency of flawed retail applications is high, with more than three out of every four (76% to be exact) applications containing at least one flaw. Fortunately, regardless of this high volume of vulnerabilities, the retail industry's rate of fixing at 74% is second only to the financial services industry at 75%, and has a better rate than healthcare, manufacturing, technology and government verticals.

Retail, in addition to success in fix rate, has the best flaw-remediation speed, with the average application taking 125 days to fix half of its known defects. This means although the retail and hospitality sector begins with more flaws than some other industries, developers are relatively faster to recognize them, buckle down, and fix the flaws in an effort to improve the application's security and protect customer data.

In looking at this data, it's clear to see the promise of the retail industry's overall effectiveness in vulnerability detection and fixing, but it begs the question: What does all of this mean for retail amidst the ongoing COVID-19 pandemic? We have to understand there has been a new normal created for business and that normal is centered around e-commerce, which heavily drives up traffic across various applications.

An important figure to note from the SoSS report is that 55% of severe retail and hospitality flaws can be grouped into information leakage. If information leakage is exploited, it will deteriorate the consumer to business relationship. In addition, an exploitation of this type would heavily damage a company's brand and reputation.

Simply put, as online traffic, users, and applications increase, retail applications security must improve alongside it. Retail organizations must take on the responsibility of integrating security throughout the software development lifecycle, running security checks on their applications frequently, and using multiple types of scans, through both static and dynamic analysis, to identify defects. Following information leakage, the next top three flaw types are CRLF injection, cryptographic issues, and code quality. These flaws can be mitigated by implementing some sort of education program to build stronger, more secure code for retail applications.

Ultimately, every application will contain security defects, but to combat the unavoidable, developers and security teams should always strive to improve their ability to find and fix security issues with speed.

One way to achieve the goal of faster remediation speed and applications with fewer flaws involves educating the developers who build and deploy the applications on avoiding common security flaws and writing secure base code. This foundation will, in turn, make it much easier to fix flaws over time and increase remediation speed. From there, AppSec programs in retail organizations will be better prepared to handle faster release cycles without slowing down developers.