Companies that focus on continuously testing their security through automated means and regular penetration testing roughly double the cost to attackers of finding exploitable vulnerabilities in their systems, according to data from security assessments and red-team engagements collected by crowdsourced security firm Synack.
The company found that the average number of times that a red-team member had to probe an asset to find a vulnerability more than doubled — increasing by 112% — on average over the past two years. In addition, the average severity of the vulnerabilities found by red-team members have decreased to a Common Vulnerability Scoring System (CVSS) score of 5.95 in 2018, down from aa CVSS score of 6.41 in 2016.
The findings suggest that companies that incorporate security into their development and operations are succeeding in hardening their systems, says Anne-Marie Chun Witt, a director of product marketing at Synack.
"You are seeing fewer vulnerabilities and/or taking longer to find them," she says. "It is taking more effort to find them and they are having to find more complex stuff. So they [companies focused on security] can say they are increasing the costs for attackers."
The data underscores that security efforts do result in measurable improvement in the security posture of companies that undertake them. Overall, companies that automated security testing — conducting it on essentially a continuous basis — had a 43% higher measure of security using Synack's proprietary metric.
Most companies — 63% — remediated vulnerabilities in less than three months. Among the laggards were e-commerce companies, retailers, and state and local government and education.
"Some ind ..
Support the originator by clicking the read the rest link below.
