Skip to content Skip to navigation

Report: Healthcare Industry Needs to Improve Application Security Practices

October 18, 2016
by Heather Landi
| Reprints

The healthcare Industry significantly lags behind other industries when it comes to fixing security vulnerabilities and has the highest prevalence of cryptographic and credentials management issues, according to a security report by Veracode. Given the recent ransomware and other cyber attacks on healthcare organizations, the industry’s low performance on these application security benchmarks is troubling, the Veracode report states.

In its annual State of Software Security Report (SoSS), Veracode, a software security firm, presents metrics drawn from code-level analysis of billions of lines of code across 300,000 assessments performed over the last 18 months.

The report revealed that the continued and persistent use of components in software development is creating systemic risk in the country’s digital infrastructure. However, the report also found that companies achieve accelerated benefits when their application security programs reach maturity. These finding indicate that the growing trend of focusing on digital risk at the application layer and building security into DevOps processes (DevSecOps) can yield great results for organizations in reducing risk without slowing down software development.

One of the key findings of the report is that the prevalent use of open-source and third-party components is creating unmanaged risk. Approximately 97 percent of Java applications contained at least one component with a known vulnerability, according to the report authors.

“The prevalent use of open source components in software development is creating unmanaged, systemic risks across companies and industries,” Brian Fitzgerald, CMO at Veracode, said in a statement. “Today, a cybercriminal can focus on a single vulnerability in one component to exploit millions of applications. Software components are used by every industry and for software of all kinds, and given our dependence on applications, the ease at millions of applications can be breached has the potential to create havoc in our digital infrastructure and economy.”

When looking at healthcare specifically, healthcare as an industry now has the lowest vulnerability fix rate, second-lowest OWASP (Open Web Application Security Project) pass rate and the highest prevalence of cryptographic and credentials management issues. The healthcare industry OWASP policy compliance pass rate is 33 percent, with government being the lowest at 25 percent.

According to the report authors, one of the most telling measures of the state of software security by industry is the vulnerability fix rate. When looking at fix rates by industry vertical, the healthcare industry ranks last for its vulnerability fix rate, and it lags the top performer, manufacturing, by a two-to-one ratio when it comes to fixing critical cyber errors.

“Does the gap reflect an inability to appropriately address vulnerabilities once they’ve been found, or does it point to some other structural constraint that holds healthcare back?” the report authors asked.

The research also highlights the challenges that still exist in software development more broadly. For example, 60 percent of applications failed basic security requirements upon first scan, which means fewer than four out of 10 applications pass security policy requirements on initial assessment. “The fact that this number fundamentally doesn’t change year over year indicates that there’s a lot of software out there that has still not been brought through a formal security improvement process—whether unremediated legacy code or new code that’s not developed via a rigorous secure software development lifecycle (SDLC),” the report authors wrote.

The report found that when companies follow best practices and implement programs with consistent policies and practices for secure development, they are able to remediate vulnerabilities at a higher rate. The study showed that the top quartile of companies fix almost 70 percent more vulnerabilities than the average organization. Additionally, best practices like remediation coaching and eLearning can improve vulnerability fix rates by as much as six-times.

According to the report, giving software developers more power improves security as developers using sandbox technology to scan apps prior to assurance testing show a significant improvement in fix rates.

Additionally, training matters, the report authors wrote, as best practices like remediation coaching and eLearning can improve vulnerability fix rates by as much as six times over.

 

 

Topics

News

CMS Looks to Increase Patient Engagement with New Models

The Centers for Medicare & and Medicaid Services (CMS) has announced two new models from the CMS Innovation Center (CMMI) that will aim to increase patient engagement in care decisions by putting more information in the hands of Medicare beneficiaries.

Medtronic, Fitbit Integrating Health and Activity Data for Diabetes Management

Fitness wearables company Fitbit, based in San Francisco, and Dublin, Ireland-based Medtronic, a medical device company, have teamed up to integrate health and activity tracking for patients living with diabetes and their physicians and care teams.

UC San Diego Health Offering EHR, iPad Access to Patients

Patients at the recently-opened Jacobs Medical Center at UC San Diego Health can be in more command with their own experience by assessing their own medical information, controlling room features and more.

Texas Medical Center, Australia Form BioBridge to Develop Health Innovation

Houston-based Texas Medical Center (TMC) and the Melbourne-based Health Informatics Society of Australia (HISA) are collaborating on a health startup exchange program.

Teladoc Hits 101K Patient Visits in November

Telehealth vendor Teladoc announced this week that it totaled 101,600 e-health patient visits in November, setting a company record.

Research of mHealth Apps Reveals Significant Gaps in Quality

An evaluation of 137 patient-facing mobile health apps revealed that few apps address the needs of the patients who could benefit the most, according to research in December’s issue of Health Affairs.