2024年软件漏洞洞察报告：基于20万次web应用安全扫描数据英文版 .docxVIP

2024

SoftwareVulnerabilitySnapshot

InsightsintoCriticalVulnerabilitiesfromover200,000ApplicationSecurityScansbyBlackDuck

Tableofcontents

ExecutiveSummary1

AboutBlackDuck1

KeyFindings1

PotentialBusinessImpactSuggestedbytheData3

Recommendations4

IndustrySectorsRepresentedinThisReport5

FundamentalsofDynamicApplicationSecurityTesting6

KeyCharacteristicsofDAST6

DASTintheModernSecurityLandscape6

DASTandOtherTestingMethodologies6

DASTinPreproductionandProduction7

VulnerabilityLandscapeAnalysis8

Top10VulnerabilityClassesIdentified8

Critical-RiskandUrgentVulnerabilities10

OWASPTop10CategoryAnalysis11

Industry-SpecificVulnerabilityTrends12

TheInterplayofDAST,SAST,andSCA15

ComparativeStrengthsinDetectingSpecificVulnerabilities15

SynergiesBetweenTestingMethodologies16

Conclusion17

BlackD

ExecutiveSummary

Thisreportanalyzesdatafromover200,000dynamicapplicationsecuritytesting(DAST)scansconductedbyBlackDuckonapproximately1,300applicationsacross19industrysectorsfromJune2023toJune2024.

Thefindingsprovideinsightsintothecurrentstateofsecurityforweb-basedapplicationsandsystems,andthepotentialimpactofsecurityvulnerabilitiesonbusinessoperationsinhigh-risksectorssuchasFinance,Insurance,andHealthcare.

ThereportalsoexamineshowDASToffersacrucialcomplementtoothersecuritytestingmethods,suchasstaticapplicationsecuritytesting(SAST)andsoftwarecompositionanalysis(SCA),andprovidesauniqueperspectiveonapplicationsecuritybymimickingreal-worldattackscenarios.

AboutBlackDuck

FormerlytheSynopsysSoftwareIntegrityGroup,BlackDuckoffersthemostcomprehensive,powerful,andtrustedportfolioofAppSecsolutionsintheindustry.Wehaveanunmatchedtrackrecordofhelping

organizationssecuretheirsoftwarequickly,integratesecurityefficientlyintheirdevelopmentenvironments,andsafelyinnovatewithnewtec