Most secure Web programming language? It depends.
Connecting state and local government leaders
Whether a website was built with new or legacy programming languages, the security risk is about the same, according to a new website security report.
Whether you use a new or legacy software programming language to build your website, the security risk is the same, according to application security provider WhiteHat Security in its 2014 Website Security Statistics Report.
“Risk exposure does not vary widely between languages … In fact, there was no statistical difference, in terms of the average number of vulnerabilities per slot, between any of the languages in this study,” noted the report. WhiteHat Security defines the boundaries of a Web application as a “slot.”
“Deciding which programming language to use is often based on considerations such as what the development team is most familiar with, what will generate code the fastest, or simply what will get the job done,” said Jeremiah Grossman, founder and iCEO of WhiteHat Security in announcing the report.
WhiteHat performed vulnerability assessments of more than 30,000 websites using .NET, Java, ASP, PHP, Cold Fusion and Perl. The most widely used languages were .NET (28.1 percent of Web applications), Java (24.9 percent) and ASP (15.9 percent).
However, programming language preferences do seem to vary by industry, says Whitehat The financial services sector has the highest number of ASP sites by count, by almost 3 to 1. More than 80 percent of gaming industry sites are written in PHP, and 49 percent of applications in the banking industry were written in Java & 42 percent in .Net.
In the government sector, a half of those surveyed reported having used ASP, .NET and Java, while a quarter were PHP users.
The programming language .Net had an average of 11.36 vulnerabilities per slot, Java 11.32 and ASP 10.98. The most secure language, ColdFusion, had six vulnerabilities per slot. Perl had seven vulnerabilities per slot and PHP had 10.
While 31 percent of all vulnerabilities were in .NET, the report noted that there were more websites written in .NET than all of the other languages in the study and “that there was no evidence to suggest that .Net is any less secure based on this data point.” Instead, the study correlated the greater number of vulnerabilities to the fact that .NET sites tend to be larger and more complicated than others.
Java accounted for 28 percent of vulnerabilities found and ASP 15 percent. “Again, the number of applications written in the language along with the complexities of the websites has to be considered as a contributing factor,” said the report. PHP also accounted for 15 percent of vulnerabilities discovered. ColdFusion only accounted for 4 percent of vulnerabilities and Perl 2 percent.
Cross-Site Scripting (XSS) was the most common vulnerability, except in .NET, where information leakage was its number one vulnerability. XSS enables attackers to inject client-side script into Web pages viewed by other users and bypass access controls. Information leakage is when a Web site reveals sensitive data, such as developer comments or error messages, which may aid an attacker in exploiting the system.
Some other vulnerability findings:
- ColdFusion had a rate of 11 percent SQL injection vulnerabilities, the highest observed, followed by ASP with 8 percent and .NET at 6 percent.
- Perl had an observed rate of 67 percent XSS vulnerabilities, over 17 percent more than any other language.
- Many vulnerability classes were not affected by language choice.
Remediation rates, the rate at which vulnerabilities are addressed, remains a key indicator of application security, says WhiteHat.
“We were somewhat surprised to find that languages that have been around for decades were actually able to keep pace, with more modern languages when it came to remediation of some vulnerability classes,” said Gabriel Gumbs, director of solutions architecture for WhiteHat Security who also led the research team on this project.
“For instance, Perl bested the pack when it came to remediating XSS vulnerabilities, which was the most prevalent vulnerability across all languages. Likewise SQL injection had a 96 percent remediation rate in ColdFusion applications, and every single abuse of functionality vulnerability found in ColdFusion sites was remediated.”
Among its recommendations for improving Web programming security, WhiteHat suggested:
- Test software in all phases of development, including code reviews of Web services.
- Include security risk assessments at the architecture and design stage of application development.
- Include application security into existing IT governance frameworks.
NEXT STORY: NIST drops crypto algorithm