Open Source Security (OSS)

The term "open source" refers to software in the public domain that people can freely use, modify, and share. The adoption of third-party open source software (OSS) has increased significantly over the last few years to help augment proprietary code developed in-house and to accelerate time-to-market. Taking advantage of OSS projects can speed application development and help get compelling business applications to market faster. But the use of OSS also brings with it certain challenges that the organization needs to manage, such as balancing the risk/reward equation as you navigate the trade-offs between agility, quality, vulnerability, and software security.

What is open source security?

Open source security refers to the tools and processes used to secure and manage open source software and compliance from development to production. The best of these open source security tools automatically discover open source dependencies in your applications, provide critical versioning and usage information, and trigger alerts when risks and policy violations are detected anywhere across the SDLC. Then in production, they automatically monitor, block, and alert on attacks targeting any open source vulnerability so that you can take quick action.

There are two types of open software/open source projects:

• Project/Community open source software is developed and managed by a distributed community of developers who cooperatively improve and support the source code without compensation. These source community projects may be copyrighted by the contributors directly but larger projects are typically run by non-profit foundations. Well-known examples of community open source projects are Linux and Apache Web Server.
• Commercial Open Source Software, or COSS, describes open source software projects for which the full copyright, patents, and trademarks are controlled by a single entity. The owner only accepts source code contributions if the contributor transfers copyright of the code to this entity. They may distribute their software for free or a fee. Their business model typically includes revenue from providing technical support and consulting services. In terms of revenue from licensing, Red Hat is still the largest COSS company, but Facebook is the largest COSS code contributor.

Open source code is used by companies in all industries and of all sizes. Aside from the widely-known open source operating systems on the market, such as Linux, FreeBSD, and OpenSolaris, enterprise users also leverage open source productivity software, open source tools for administrators and developers, and various source libraries used to build their own software.

Even commercial software is typically built to include open source code. As enterprises are moving to agile methodologies, open source projects become even more valuable, and there are more open source tools available for them. New software developers entering the market today are trained on open source use and are typically very comfortable with using open source technologies.

Open source software pros (best case scenario)

• Try before you buy
• Free support
• Open standards
• Fewer bugs and faster fixes
• Better software security
• No vendor lock-in

Open source software cons (worst case scenario)

• Reduced competitive advantage
• Minimal support leverage
• Ease of use
• Vendor long-term viability
• Increased business vulnerability and risk

Aside from Red Hat, large financially strong open source software vendors are few and far between. Great products may come from smaller, more nimble OSS companies, but there is a significantly higher risk that they won’t be there for the long term, making this a vulnerability to take seriously.

Just how secure is open source software?

As far as security is concerned, the big win in using open source software should be transparency. Since there is “a community of eyes” working with and inspecting open source code coming from open source projects, there should be fewer bugs, with any flaw or vulnerability spotted and fixed quickly.

But there are two “gotchas” about the “many eyes” theory. First, by far the majority of projects are maintained by either a single developer or a small team of “volunteer” developers. How often they actually have the time and resources to look at and update their code is a complete unknown, and certainly not subject to any formal process. In other cases, the software may not be maintained at all. Those who create and contribute free software are under no obligation to maintain it. Indeed, most such software usually comes with some kind of “as is” disclaimer. The reverse side of that disclaimer is if the developer isn’t responsible for the code, then it is clearly the responsibility of users to “own their sources” and make sure the code is safe.

If you’re not actually a developer, you might be surprised at just how much of your organization’s software relies on open source components. Using community-produced software saves development time and cost, and allows organizations to essentially outsource maintenance to a worldwide community of organizations and volunteer developers. These wins have led to suggestions that there’s more open source code than proprietary code in the majority of organizational codebases, with on average a single codebase containing over 250 open source components.

Is open source security a good fit?

Despite its obvious advantages, open source software (OSS) will always come with certain quality and security risks. So before taking advantage of OSS and deciding on your open source security strategy, it’s important to ask these questions:

• Does a particular piece of open source software meet the organization’s software quality standards?
• Will using an open source component introduce security vulnerabilities, now or in the future?
• Who is responsible for the security of open source software dependencies?
• Do we have infrastructure in place to deal with each issue and vulnerability as it arises?
• Who understands and will manage OSS risks on an ongoing basis?

Open source advantages and risk profile

Adopting OSS reduces overall development costs and frees developers to work on more value-added tasks. However, as companies use more open source code, they risk introducing vulnerabilities that predispose them to cyberattacks and breaches.

These stats give us a quick look at the OSS vulnerability/risk profile:

• 96% of applications include some form of OSS
• 67% of applications contain open source vulnerabilities
• 90% of software applications are not security tested
• 41% of vulnerabilities are detected and remediated manually

A major advantage of open source is its lower cost. And when there's a problem, the company can open up the code and fix it immediately rather than waiting for a vendor to respond. But the challenge is to tap into the advantages of open source without falling victim to any of its security traps.

Open source security tools

Open source security tools are designed to manage OSS security and compliance from development to production. The best of open source security tools:

• Automatically create and maintain organization-wide inventory of open source components mapped to applications, servers, and environments to identify what runs where, and what needs to be secured.
• Continuously evaluate OSS components in your application portfolio for known and unknown vulnerabilities, as well as open source license risk.
• Set and automatically enforce custom policies across the SDLC and provide real-time feedback to security and development teams.
• Prioritize remediation efforts on vulnerabilities that really matter by accurately identifying whether vulnerable open source components are actually used by the application.
• Continuously monitor production applications and block attacks on vulnerable open source code to prevent exploitation at runtime.
• Provide real-time correlation of vulnerabilities, OSS license information, and other library metadata to components in inventory

Increased software risk – more risk to the business

Applications that use OSS are a primary target for cybercriminals because once a vulnerability is discovered, adversaries can attack virtually any application built using that now-vulnerable OSS. This means software development, security, and operations teams must factor in and address the risk of OSS. And, with more of every business based on software, those software vulnerabilities represent tangible, and in some cases, significant business risks.

Digital transformation is driving the creation of more software, delivered faster. OSS helps meet the need for speed, but can also introduce unanticipated risk to the business. Contrast enables development and security teams to embed application security within the entire Software Development Life Cycle (SDLC) quickly and inexpensively from development, QA and production. Software becomes “self-protecting,” so applications built on OSS can be created and deployed into production faster across many environments without compromising on their security. Contrast Security is uniquely positioned to deliver affordable, automated application security solutions that address OSS risk at scale.

Implementing a good open source security strategy

It’s important to recognize that free code comes at a cost, and that cost is responsibility. Businesses need to “own their sources,” because it is the business that will bear the brunt of any losses, both financial and reputational.

In order to ensure that your codebase is secure, you need visibility into your open source code dependencies as well as a very clear understanding of what that code is doing across your applications and systems. There are tools that can be used to audit open source code for known vulnerabilities and databases that can be searched for detailed information and remediation guidance. There are also AI driven solutions like Contrast OSS, that deliver automated open source risk management by embedding security and compliance checks in applications throughout the development process and then performing continuous monitoring in production. Contrast is the only solution that can identify vulnerable components, determine if they are actually used by the application, and prevent exploitation at runtime.

A fully automated solution that works with your existing workflows

Contrast offers a DevSecOps solution to managing open source software risk. Contrast OSS works by deploying an intelligent agent that instruments the application with smart sensors to analyze code in real-time from within the application. Contrast is the only solution that can identify vulnerable components, determine if they are actually used by the application, and prevent exploitation at runtime. All of this information is streamed to security and development teams through the tools they already use, enabling short feedback loops and quick action.

Key benefits

Open source security empowers developers and development teams to use open source code confidently, taking advantage of the many benefits, while at the same time staying ahead of the risk curve to ensure that their organizations are protected.

Scale and ensure security while accelerating development with end-to-end automation: Contrast OSS discovers open source components in your applications automatically. It provides critical versioning and usage information, and triggers alerts when risks and policy violations are detected at any stage of the SDLC. In production, Contrast OSS monitors, blocks, and alerts on attacks.

Empower developers by catching issues early and enabling faster remediation: Contrast OSS enables early detection of vulnerabilities and open source license risk in the developer environment with continuous verification across CI/CD pipelines. Unlike legacy Software Composition Analysis (SCA) tools, Contrast OSS performs runtime analysis to accurately identify whether vulnerable components are actually used by the application.

Deploy the right security control to protect against known and zero-day exploits: Beyond automatically detecting risk, Contrast OSS provides runtime protection so attacks on vulnerable open source code are automatically monitored and blocked to prevent exploitation in production. Applications self-monitor and self-defend against attacks targeting open source components in production.

Continuous visibility and self-updating software risk intelligence: Contrast OSS monitors your entire application portfolio including third-party and custom code, automatically applying new vulnerability and license risk intelligence and policies. This eliminates the need for disruptive scans and re-scans of code repositories.

A single solution for your open source and custom code: Leverage a single deployment and assessment process to identify vulnerabilities in open source and your custom code. No need to implement multiple tools, orchestrate between different analysis engines, or run complex correlations.

Contrast Security is the world’s leading provider of security technology that enables software applications to protect themselves against cyberattacks, heralding the new era of self-protecting software. Contrast's patented deep security instrumentation is the breakthrough technology that enables highly accurate assessment and always-on protection of an entire application portfolio, without disruptive scanning or expensive security experts. Only Contrast has sensors that work actively inside applications to uncover vulnerabilities, prevent data breaches, and secure the entire enterprise from development, to operations, to production.