Study: Largest vendors account for fewer software flaws

Though it might not seem that way, the top 10 most vulnerable software vendors — and, yes, that includes Microsoft Corp. — are contributing a smaller percentage of all vulnerability disclosures per year compared to five years ago.

That’s according to an analysis by Gunter Ollmann, director of security strategies at IBM’s Internet Security Systems X-Force team.

Ollmann, who crunched vulnerability data gathered by X-Force between 2002 and 2006, said the overall percentage of security flaws disclosed by the most vulnerable software vendors dropped from 20.2 per cent in 2002 to 14.6 per cent during that period.

Much of that decrease is likely the result of improved quality assurance and testing processes by the most vulnerable software vendors, Ollmann said. Most of their software packages have been through multiple versions and have been combed thoroughly for vulnerabilities by security researchers, Ollmann said.

In the past five years, the list of the most vulnerable vendors has consistently included Microsoft, Cisco Systems Inc., IBM Corp., Sun Microsystems Inc. and the Linux Kernel Organization, Ollmann said. Others on the list for 2006 were Oracle Corp., Apple Inc, Mozilla and Adobe Systems Inc.

Together, these vendors accounted for 964 vulnerabilities in 2006, or roughly 14 per cent of the total disclosed by all vendors. The remaining 85 per cent or more were accounted for by smaller vendors. For instance, nearly 1,000 vulnerabilities were reported by relatively small vendors of PHP applications, he said.

Would you recommend this article?

Share

Thanks for taking the time to let us know what you think of this article!
We'd love to hear your opinion about this or any other story you read in our publication.


Jim Love, Chief Content Officer, IT World Canada

Featured Download

Related Tech News

Get ITBusiness Delivered

Our experienced team of journalists brings you engaging content targeted to IT professionals and line-of-business executives delivered directly to your inbox.