Report: Commercial Software Riddled With Open Source Code Flaws
Black Duck Software on Wednesday released its 2017 Open Source Security and Risk Analysis, detailing significant cross-industry risks related to open source vulnerabilities and license compliance challenges.
Black Duck conducted audits of more than 1,071 open source applications for the study last year. There are widespread weaknesses in addressing open source security vulnerability risks across key industries, the audits show.
Open source security vulnerabilities pose the highest risk to e-commerce and financial technologies, according to Black Duck's report.
Open source use is ubiquitous worldwide. An estimated 80 percent to 90 percent of the code in today's software applications is open source, noted Black Duck CEO Lou Shipley.
Open source lowers dev costs, accelerates innovation, and speeds time to market. However, there is a troubling level of ineffectiveness in addressing risks related to open source security vulnerabilities, he said.
"From the security side, 96 percent of the applications are using open source," noted Mike Pittenger, vice president for security strategy at Black Duck Software.
"The other big change we see is more open source is bundled into commercial software," he told LinuxInsider.
The open source audit findings should be alarming to security executives. The application layer is a primary target for hackers. Thus, open source exploits are the biggest application security risk that most companies have, said Shipley.
Understanding the Report
The report's title, "2017 Open Source Security and Risk Analysis," may be a bit misleading. It is not an isolated look at open source software. Rather, it is an integrated assessment of open source code that coexists with proprietary code in software applications.
"The report deals exclusively with commercial products," said Pittenger. "We think it skews the results a little bit, in that it is a lagging indicator of how open source is used. In some cases, the software was developed within three, five or 10 years ago."
The report provides an in-depth look at the state of open source security, compliance, and code-quality risk in commercial software. It examines findings from the anonymized data of more than 1,000 commercial applications audited in 2016.
Black Duck's previous open source vulnerability report was based on audits involving only a few hundred commercial applications, compared to the 1,071 software applications audited for the current study.
"The second round of audits shows an improving situation for how open source is handled. The age of the vulnerabilities last year was over five years on average. This year, that age of vulnerability factor came down to four years. Still, that is a pretty big improvement over last year," Pittenger said.
Comments
Post a Comment