2023年4月25日

分享这篇文章提供的新闻分享这篇文章红木市,加利福尼亚州,2023 / Synack从4月25日英超安全测试平台,今天发布了就职的漏洞报告突显出三大软件缺陷发现公司的全球精英网络安全研究人员。研究结果是基于2022年创纪录的14800可利用的漏洞发现Synack红色团队(SRT),一群世界上最值得信赖的和熟练道德黑客。破碎的访问控制问题提出了最常见的风险Synack客户去年,占39%的漏洞发现其中活动期间,根据该报告。注射缺陷,包括跨站点脚本(XSS)和SQL漏洞——排在第二位研究人员经常发现绕过周边防御的方法。第三个最常见的漏洞,识别和身份验证失败,占所有的6%接受了SRT提交。”组织正努力确保他们的攻击表面对手找到越来越多的创造性的方式利用著名的漏洞,“Synack首席执行官兼联合创始人杰伊·卡普兰说。“我们首次的漏洞报告强调了持续安全测试的重要性来修复这些漏洞和解决他们的根源才导致昂贵的违反。”The report draws on data from security assessments carried out on Synack's global customer base and aligns with vulnerability categories in the OWASP Top 10 standard awareness document. The 1,500+ members of the SRT collectively spent 35,700 days testing Synack customer assets last year, including cloud, application programming interface, web application, host infrastructure and mobile attack surfaces. Other takeaways from the report: 40% of vulnerabilities in 2022 were ranked "high" or "critical" in severity XSS vulnerabilities fell by 44% from 2021 to 2022 as organizations deployed more effective defensive techniques Exploitable API vulnerabilities have emerged as a fast-growing risk To read the full report, please visit: https://go.synack.com/state-of-vulnerabilities-2023 ABOUT SYNACK: Synack's premier on-demand security testing platform harnesses a talented, vetted community of security researchers and smart technology to deliver continuous penetration testing and vulnerability management, with actionable results. We are committed to making the world more secure by closing the cybersecurity skills gap, giving organizations on-demand access to the most trusted security researchers in the world. Headquartered in Silicon Valley with regional teams around the world, Synack protects federal agencies, DoD classified assets and a growing list of Global 2000 customers. For more information, please visit www.synack.com . SOURCE Synack