Hard to Port! - A Snapshot of the Vulnerability Landscape in 2015
summary
edgescan’s 2015 dataset shows specifics not slogans: thousands of assets from Dec 2014–Nov 2015 reveal 15.1% of assets carry high/critical risk, web apps average 4.87 XSS instances each with some apps having hundreds, two thirds of SSL-enabled servers have issues (61.4%) and 25% are POODLE-vulnerable. Continuous testing plus human verification powers the analysis; remediation ranges from days for developer fixes to nearly a year for component management, and using tools like dependency-check could have mitigated about 63% of problems.
AI-written summary · about
chapters (16)
- 0:00Start
- 0:34Contents
- 0:47Who am I - Rahim Jina
- 2:55Why are we here?
- 3:20How do we measure risk?
- 4:57Why do an annual report?
- 6:33Where did you get these numbers?
- 7:362015 - Year in Review
- 8:442015 - Overview
- 9:18Security by Numbers
- 20:35Thoughts - Headers
- 22:09Thoughts - Component security
- 22:42Thoughts - Software Food Chain
- 24:03Thoughts - Components
- 24:43Thoughts - Patching & Component Management
- 26:02Thoughts - Pushing Left
related talks
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...
30mAppSec Timeline: Wins, Failures, Promises, and Predictions
42mHOW VULNERABLE IS YOUR APP? AND HOW TO FIX IT.
40mEmbracing Security - A Changing DevOps Landscape
33m40,000 CVEs and Counting: What 60 Years of AppSec Tells Us About 2026
55mBreaking and Fixing Web Application Security
50mWorrisome Web Vulnerability Trends in the Race to Innovation
39mWe Are All Equifax: The Data Behind DevSecOps