Virginia scanning program slashes vulnerabilities in web apps

The Virginia Information Technologies Agency cut the number of high-risk vulnerabilities affecting its web applications by 30 percent in one year by implementing a vulnerability-scanning program that includes penetration testing.

VITA’s Web Application Vulnerability Scanning Program, implemented in 2016, uses a scanning tool from web security firm Acunetix to check more than 1,600 public-facing web applications and another couple thousand internal ones at more than 67 state agencies every quarter. It can identify more than 600 web application vulnerabilities, including the Open Web Application Security Project's top 10 risks and configuration errors.

“We check and make sure that we’ve identified the vulnerabilities for each one of those and that there’s a remediation plan to fix those at least high and medium vulnerabilities on the systems so that we’re protecting ourselves,” said Virginia's Chief Information Security Officer and Deputy CIO Mike Watson said. “We’ll actually test the vulnerabilities we’re finding and see if they’re executing properly.”

Additionally, the commonwealth security and risk management web application vulnerability team helps agencies interpret scan results. Watson credits that extra step with the decrease in high-risk vulnerabilities in the fourth quarter of 2017, compared to the same time the year before.  The number of medium-risk items rose slightly, but that’s to be expected, because more vulnerabilities were announced and agencies added sites, he added.

Watson’s team maintains a sensitive system inventory and a system inventory, and the team scans every URL in those inventories to ensure that vulnerabilities are logged in VITA’s tracking system. After agencies address any vulnerabilities, VITA re-scans the systems. High-risk vulnerabilities, such as SQL injections, must be fixed quickly, while medium-risk ones, such as a brute force-style attack or encryption problems, have a longer deadline.

VITA had been performing web application vulnerability scanning for years, but it was not meeting agencies' expectations, he said. “The No. 1 thing we kept hearing back from agencies was, ‘It doesn’t work’ or ‘I’m not seeing that vulnerability that you’re finding,” Watson said. “So, we took it that further step to make sure that we were actually testing vulnerabilities to see if they were being exploited or not.”

The program does more than identify and test vulnerabilities. VITA also offers services to agencies to help them understand and fix the problems. That’s because many agencies lack the in-house expertise to address the issues.

 “We’re not giving them just a ‘Hey, this tool picked up this issue. Why don’t you go look into it?’ We’re able to show them exactly where the problem is, point them in the right direction for exactly what type of changes are necessary in order to make their web application secure,” he said. “I really think it’s paid off in dividends for us in having the conversations with the agencies.”

“The team that we have here does everything from running the test, explaining what the issues are, working with the developers,” Watson added. “We even have recommended training plans in the event the developers don’t understand issues."  VITA even has source code scanning as part of a new contract vehicle so that agencies can test their code prior to putting it up on the web, he explained. "We’ve been trying to focus very much on the web application development side.”

The service is free for the 67-plus agencies and available to other government entities within the commonwealth for a fee. For example, if Fairfax County were to request scanning, it would cost $250 per scan and $125 per hour of assistance.

However, if there's a security incident that involves a web application, "we’ll test that for free,” Watson said. “That doesn’t cost anything as part of the response to figure out whether there’s a vulnerability that was used in order to get in.”

Looking ahead, Watson said he plans to shift from a focus on public-facing applications to internal ones and to tie a full life-cycle approach to the testing process. That means working with developers to ensure that they’re not publishing insecure code.

“The first year is a lot of times [about] education, explaining what’s going on and telling people how it works,” Watson said. “We’ll be trying to push people a little bit harder over the coming year, year and a half, to reduce their vulnerability count even further than that 30 percent.”

Other states have similar scanning protocols. For instance, New York used automated tools to scan systems, computing and network devices, web applications and application code, and issued a standard for vulnerability scanning in early 2015. Like VITA, the Texas Department of Information Resources offers web application vulnerability scanning to state agencies at no cost.