Java companies hit hardest by third-party vulnerabilities, report says

Java companies are the most-impacted by third-party vulnerabilities, in line with the “State of DevSecOps 2024” report simply launched by cloud safety supplier Datadog.

Launched on April 17, the report discovered that 90% of Java companies have been inclined to a number of important or high-severity vulnerabilities launched by a third-party library. The typical for different languages was 47%.

Datadog’s report analyzed tens of 1000’s of functions and container pictures and 1000’s of cloud environments to evaluate utility safety. Following Java within the vulnerabilities evaluation have been JavaScript, at roughly 70%; Python, at 62%; .NET, at 50%; PHP, at 35%; and Go (golang) and Ruby, each at about 32%.

Java companies additionally have been almost certainly to be weak to real-world exploits with documented use by attackers. From a vulnerabilities listing maintained by the US Cybersecurity and Infrastructure Safety Company, 55% of Java companies have been affected, versus 7% of these of these constructed utilizing different languages.

Extra findings from the report embrace:

• No less than 38% of organizations leveraging Amazon Net Providers (AWS) had deployed workloads or accomplished delicate actions manually by way of the AWS console in a manufacturing setting inside a 14-day interval, which means they have been counting on dangerous click on operations as an alternative of automation.
• 63% of organizations proceed to depend on long-lived credentials—some of the widespread causes of information breaches—in CI/CD pipelines, even in instances the place short-lived ones can be extra sensible and safe.
• Solely a small portion of recognized vulnerabilities have been value prioritizing. 
• Adoption of infrastructure as code was excessive, however diversified throughout cloud suppliers.
• The overwhelming majority of assaults carried out by automated safety scanners have been innocent and solely generated noise for defenders.
• Light-weight container pictures result in fewer vulnerabilities.

Datadog mentioned its findings display that fashionable devops practices go hand in hand with sturdy safety measures. Safety itself helps drive operational excellence, the corporate mentioned. However safety is barely life like when practitioners are given sufficient context and prioritization to deal with what issues.