hp-security-research-cyber-risk-report-pdf-2-w-1408

HP Security Research | Cyber Risk Report 2015The availability of open-sourcesolutions might act as a doubleedgedsword for discovering andmitigatingvulnerabilities.ConclusionDespite many efforts to abstract and universalize the IoT framework there remain multipleactors and competing solutions in the market today, and the fragmentation of solutions anddevices discussed in this section is likely to continue. Addressing security concerns such asattack vectors on such devices is likely to require individual solutions for each type and family ofdevice—an extremely difficult situation. The limit on the number of possible “over the air” or “inservice” upgrade-capable devices, especially in the lower-end cheap sensor segment, is likely tomake mitigating such attacks even more difficult.Attacks could involve various layers of the device infrastructure. This could include applicationsrunning on smartphones or tablets, cloud services—including firmware and network servicestacks on Wi-Fi modules—as well as the firmware and application layer on the host processor.Various vectors of propagation could also be used, including compromising update files orexploiting network and host processor communication layer vulnerabilities, as well as possiblevulnerabilities in cloud service infrastructures and smart device applications. The availabilityof open-source solutions might act as a double-edged sword for discovering and mitigatingvulnerabilities. On one hand, common source is likely to be susceptible to the same vulnerabilityacross a span of many devices, but on the other hand it will allow the broader community todiscover, test, and mitigate vulnerabilities earlier, provided the firmware and software can beupdated in a timely manner. Unfortunately in the case of many of the simpler IoT devices, thisjust might not be possible—at least initially. There are still a number of unknowns when itcomes to the security of the IoT in practice.The final section of our report brings us full circle and to one of the most important parts of thispublication—controls. It answers the important question of why vulnerabilities arise and showsa very different view of the threat landscape. Being aware of the specific circumstances that giverise to vulnerabilities lets security practitioners address their root causes and make enterprises,not to mention your coding practices and software selection, considerably more secure.ControlsIn the past year we have seen the manifestation of several vulnerabilities that gathered a stormof media attention. The uproar around Heartbleed, Shellshock, and Poodle brought renewedscrutiny to software dependencies as they relate to software architecture. We noted new trendsin where vulnerabilities are detected, as well as continued shifts in the types of weaknessesleading to them. To gain insight into the current state of software security, we analyzed asample set of security audits performed by HP Fortify on Demand on 378 mobile apps, 6504Web apps, and 138 Sonatype reports from 113 projects. These audits include results fromstatic, dynamic, and manual analysis.In order to have a consistent view of the data analyzed for this Report, we’ve ensured that allidentified issues were classified according to the HP Software Security Taxonomy (originallythe “Seven Pernicious Kingdoms”), which was substantially updated and refined 141 in mid-2014.These updates and refinements are reflected in HP WebInspect, our dynamic analyzer. Our workto extend the taxonomy to other assessment techniques (such as manual analysis) and HPFortify products (such as HP Fortify on Demand) continues in 2015.141http://www.gartner.com/newsroom/id/2636073.49