Report: Government system vulnerabilities often unresolved

Almost 80% of government agencies have failed to address software flaws for at least a year, while 55% had enduring vulnerabilities that could be exploited in attacks, indicating "critical" security debt, Cybersecurity Dive reports.

Fifty percent of software vulnerabilities have been remediated by government agencies within 315 days on average, compared with 252 days for public- and private-sector organizations, according to a Veracode report. Additional findings showed that third-party and open-source software accounted for a majority of critical security debt on government networks despite being linked to only 10% of overall security debt. Elevated security debt among government entities has been associated with the persistence of legacy apps. Such a report, which comes after the breach of the U.S. Treasury Department using BeyondTrust exploits, should prompt the prioritization of critical security issues in government remediation efforts. "No software is perfect, and every codebase carries security debt from the moment it is created," said Georgianna Shea of the Foundation for Defense of Democracies Center on Cyber and Technology Innovation.