Video: Data mining a mountain of vulnerabilities
Posted on 22 January 2013.
Every day, software developers around the world, from Bangalore to Silicon Valley, churn out millions of lines of insecure code.

Veracode used static binary analysis on thousands of applications submitted to them by large enterprises, commercial software vendors, open source projects, and software outsourcers, to create an anonymized vulnerability data set. By mining this data we can answer some interesting questions.

There are significant differences in the quantity and types of vulnerabilities in software due to differences in where the software was developed, the type of software it is, in what language it was developed, and for what type of business the software was developed for.

Which industries have the most secure and least secure code? What types of mistakes do developers make most often? Which languages and platforms have the apps with the most vulnerabilities? Should you be most worried of internally built apps, open source, commercial software, or outsourcers? How do latent vulnerabilities relate to those most often exploited. These questions and many more will be answered as we tunnel through vulnerability mountain.

Here's the video, recorded at Hack in The Box 2012:

Chris Wysopal

Chris Wysopal (AKA Weld Pond), Veracode's CTO and Co-Founder, is responsible for the company's software security analysis capabilities.

One of the original vulnerability researchers and a member of L0pht Heavy Industries, he has testified on Capitol Hill in the US on the subjects of government computer security and how vulnerabilities are discovered in software.

Chris was one of the first vulnerability researchers for web applications and Windows, publishing advisories in Lotus Domino, Cold Fusion, and Windows back in the mid 1990′s. Around the same time he also co-authored L0phtCrack, which he still sells today, and ported netcat to Windows.


eBook: Cybersecurity for Dummies

Posted on 16 December 2014.  |  APTs have changed the world of enterprise security and how networks and organizations are attacked. These threats, and the cybercriminals behind them, are experts at remaining hidden from traditional security while exhibiting an intelligence, resiliency, and patience that has never been seen before.

Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.

Daily digest

Receive a daily digest of the latest security news.

Thu, Dec 18th