2015 is now behind us, and in terms of computer security, it was a real hurricane. Some bugs were very serious, but in general we always saw a quick response. The folks at CVE Details published a list of the companies that accumulated the most vulnerabilities in their products during the past year, and although the main names are still the same, we can extract very interesting details.
We all hope that 2016 is less problematic in terms of vulnerabilities. On the one hand, security researchers do everything possible hunting and fixing every bug in their path, and on the other, there are always malicious elements waiting to find a 0-day to blow everything up. This is especially true when we consider mobile devices, with billions of users around the globe dumping more and more tasks onto their smartphones and tablets. Without a doubt, such a large number of nearly constantly connected devices places enormous pressure on the big names of the industry, forced to protect the integrity of their platforms, their users, and the data they possess.
The 2015 Vulnerability Ranking
The folks at CVE Details have been monitoring for years the number of vulnerabilities reported by each manufacturer and developer, using as a reference the national database maintained by NIST. As happened in 2013 and 2014, Microsoft closed 2015 as the company with the largest number of bugs. This is logical since the CVE Details study includes more than a dozen Microsoft products, separated by version number. Even under these conditions, the truth is that Redmond was not so alone. Very close appears Adobe, which with only eight products registered more than 1,500 vulnerabilities (314 only in Flash Player), compared to Microsoft's nearly 1,600 in fourteen entries. The third place is occupied by Apple, with a total of 1,147 vulnerabilities spread across seven products. The most striking? Apple's two operating systems, iOS and OS X, appear at the top of the list as the most vulnerable individual products.
The fact that CVE Details generates these lists from XML feeds coming from NIST reminds us that the data are not absolute, and can have a significant margin of error in some cases. However, they have certain value to recognize the work of the companies, detect which ones have had a more complicated year than normal, and what we can expect from them in 2016.
