COMMENTARY: Open-source software (OSS) has become the backbone of modern digital infrastructure, and for good reason. It cuts development costs, offers flexibility and customization, and fosters innovation because of its collaborative nature. Its adoption grows in lockstep with today’s advancements in AI and cloud technologies that often rely on the OSS paradigm.
However, the benefits eclipse the fact that open-source carries a serious risk: dependencies and the supply chain are not always under the organization’s control.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
A vulnerability in a single dependency can have a domino effect across the whole software stack. With suboptimal maintenance of many such projects, unpatched vulnerabilities can stick around in the codebase indefinitely. Malware injection by a third-party represents a flip side to the open nature of OSS, making malicious packages cascade through numerous projects that harbor these poisoned dependencies.
According to a recent report from Synopsys, out of 936 codebases that underwent risk assessments in 2023, 84% had vulnerabilities. High-risk security gaps were found in a staggering 74% of these codebases. The mean age of the loopholes was 2.8 years, and 14% were older than a decade.
Pair these eyebrow-raising stats with the fact that open source has emerged as the foundation of more than 90% of applications globally, and it’s clear that incidents fueled by open-source software imperfections have become a serious problem.
The wake-up call was the Heartbleed Bug from 2014 that affected the OpenSSL cryptographic library and let attackers steal sensitive information like passwords and encryption keys from the memory of compromised servers. The Log4j vulnerability (Log4Shell) first hit the headlines in 2021 as a potential catalyst for remote code execution on millions of servers and devices worldwide. A memory corruption bug found in the XZ Utils data compression toolkit earlier this year offered threat actors backdoor access to numerous Linux distributions.
What to do about it
The impactful incidents highlight how open-source software, while vital to innovation, can become a liability if not carefully monitored and shielded. As dependencies grow, so does the complexity of the attack surface. This makes it crucial for organizations to implement robust open-source security strategies throughout the software lifecycle. Let’s look at some of the best practices in this area:
- Vet projects before adoption: Not all open-source projects are created equal, and some carry inherent risks because of limited community involvement, outdated code, or inadequate documentation. Before integrating OSS, examine the project’s activity level, how quickly bugs are addressed, and whether the community prioritizes security. Opt for an active, well-maintained, and properly supported project.
- Implement automated dependency management: It’s risky to manage open-source dependencies manually. Software composition analysis (SCA) tools keep tabs on the state of the company’s dependencies and flag vulnerabilities as well as licensing issues. SCA tools can ensure the team stays aware of outdated components that may introduce risks.
- Enforce security at the code level: Incorporate static and dynamic analysis in the organization’s development pipeline to identify vulnerabilities early. The former inspects the source code for security flaws, while the latter tests the software in real-world conditions. With this two-pronged approach in play, security gets baked into the code from the start.
- Monitor for vulnerabilities post-deployment: The lifecycle doesn’t end at deployment. Use continuous monitoring to identify new vulnerabilities when software gets used. Conduct regular code reviews, vulnerability assessments, and penetration testing. Tools like Dependabot help spot emerging security issues in real-time and point the DevOps team in the right direction with a patch strategy.
- Share security fixes: Contribute security fixes, code, and documentation back to the open-source community. Active participation and feedback beef-up the ecosystem and help everyone resolve bugs faster. Also, consider using crowdsourced security programs to pinpoint flaws in applications.
- Have a Plan B: Even with preventive measures, vulnerabilities can still slip through. Leverage a solid incident response plan to mitigate any damage. The team must know and follow clear protocols to identify, report, and resolve incidents.
- Train developers on security: To reduce the risk of vulnerabilities making it into production, offer regular workshops and training sessions about safe handling of dependencies and secure coding techniques. Make sure that developers adhere to standards like OWASP Top 10 to address the most common web application security risks proactively.
OSS holds great promise as the mainstay of the global software environment for years to come, but its flexibility and accessibility also introduce tangible challenges. The future of OSS security lies in collaboration, innovation, and an unwavering commitment to best practices, so it’s in the organization’s best interest to stay ahead of the curve.
David Balaban, owner, Privacy-PC
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
