|
By Iain Thomson
itnews.com.au
8 April 2008 07:54AM
A study into companies that outsource code development has found that
six out of 10 do not include security specifications..
The Quocirca report found that many companies are outsourcing more code
development than ever before, and that nine out of 10 outsource more
than 40 percent.
The National Institute of Standards and Technology reported recently
that 92 percent of vulnerabilities affecting computer networks are
contained in software applications.
However, when it comes to specifying outsourced code, one in five
companies do not even consider security when designing applications.
Fran Howarth, principal analyst at Quocirca and author of the report,
said: "The findings indicate that not enough is being done by
organisations to build security into the applications on which their
businesses rely.
"They are also entrusting large parts of their application development
needs to third parties.
"This creates an even greater onus for organisations to thoroughly test
all code generated for applications, without which they could be playing
into the hands of hackers."
The top outsourcers are financial services organisations, 72 percent of
which outsource more than 40 percent of new code development.
Only seven percent of utility companies outsource more that eight
percent of code development.
Howard Schmidt, a board member at Fortify Software, and a former
cyber-security advisor to the White House, said: "These survey results
help explain the sudden rise in data breaches.
"It should serve as a wake-up call to any executive whose company sits
on a pile
|
