Open Source Components Save Time but Need to be Closely Monitored

A recent trend has shown organizations are embracing open source code, to the extent that today, open source components comprise between 60-80 percent of the code in modern applications. Software development teams are learning that using open source code helps them build more secure and powerful web applications, faster.

Development teams can benefit from the many different open source libraries and frameworks that are updated and published by the open source community and are easy to find in popular resources like GitHub and Stack Overflow.

Although there are obvious reasons for developers to use open source components, they come with different risks. Constantly securing your open source products can be a massive time-consuming challenge which requires the correct tools for your organization to address these threats.

When it comes to open source components the most common security risk is known vulnerabilities. These are vulnerabilities and fixes, published by the security community or the open source community, that are available for anyone to view and can be used by hackers to exploit victims. The risk of using open source components with known vulnerabilities received the proper attention having been listed on OWASP’s Top 10 since 2013.

Open source components are used in different kinds of web products, and an open source security vulnerability which is found in a single component can have a major impact on a vast amount of web applications. The open source community maintains the different open source components and are quick to alert users when a new vulnerability is discovered.

To help users maintain secure open source components, security researchers publish their findings on various security advisories, listing the vulnerabilities, how to fix them and how a vulnerability might be exploited. While this helps security teams and developers to fix their applications, hackers are also paying attention here for free intelligence on what to target and how.

The time sensitive challenge here is to stay one step ahead of the hackers. Regrettably the majority of development teams are unaware of how many of their products depend on open source components, and usually don’t keep inventory of which open source components they are using in their products. This can be a major issue, as they can be targeted via a vulnerable open source component that they had no idea that they were using.

For example, this is what occurred in the Equifax breach last September when the company was hacked through a vulnerable version of Apache Struts 2 (CVE-2017-5638), which lead to the theft of 145.9 million personally information records, including social security and credit card numbers. According to the many reports, the attack occurred two months after the vulnerability was discovered and announced, embarrassing Equifax for the lack of taking the fundamental steps to keep their customers’ data secure.

Automation is a Must with Open Source Components

In the exciting world of fast paced development which is very dependent on open source components, manual tracking your company’s open source components is too slow. In order to deploy more products in a timely manner the best solution to stay secure is to automate the selection and management process of open source components. Automated solutions present the opportunity to stay on top of every open source component that your team of developers is using in the software development environment. When looking for the right kind of tools to identify open source components and alert your security team of potential risk, Software Composition Analysis (SCA) tools are your answer.

When implementing the correct open source security process, your development and security team need to work together to catch issues early on, thus avoiding bigger issues down the line. If you integrate an SCA tool into your software development lifecycle, you can locate vulnerable components before they are inserted into your coding environment. This will help prevent unwanted delays and late-night fixes later on, when developers would have to deal with the vulnerable component in your products before release.

It is crucial for your organization to be alerted when new open source vulnerabilities are discovered. This will give your security teams the proper time quickly fix vulnerable components before the hackers find them in your applications.

By implementing an automated SCA tool, organizations can automate companywide policies across their development and products, significantly reducing the risks to known vulnerabilities in your open source component usage.