Open Source: Both Hero and Villian of App Development

Applications based on open-source software are everywhere. The Linux Foundation estimates that most modern applications contain 70-90 percent open-source software. And by some estimates, 96 percent of all enterprise software is using some amount of open source.

The advantage of open source is that the reusability of core capabilities makes the software development schedule quicker and the features of applications created much richer than they could ever possibly be.

A report by GitHub and reported on ZDNet commented that “you would be hard-pressed to find a scenario where your data does not pass through at least one open-source component. Many of the services and technology we all rely on, from banking to healthcare, also rely on open-source software. The artifacts of open source code serve as critical infrastructure for much of the global economy, making the security of open-source software mission-critical to the world.”

But the ubiquity of open source can cause problems. When vulnerabilities are uncovered, security issues can touch huge numbers of projects and end-users. Software apps that go unpatched for a long period after vulnerabilities are revealed can expose user data to hackers.

Matt Jarvis, director of developer relations at Snyk, quoted by Cybersecurity Dive said that “Open source has changed the way developers work, and has brought more efficiency, innovation and speed in the way modern applications are made. This ubiquity has also made it a target, as attackers have realized that the open-source supply chain may be easier to exploit than directly looking for vulnerabilities in end-user applications.”

Tim Mackey, principal security strategist at Synopsys, said that “there are justifiable reasons for not keeping software completely up-to-date. But, unless an organization keeps an accurate and up-to-date inventory of the open source used in their code, an outdated component can be forgotten until it becomes vulnerable to a high-risk exploit, and then the scramble to identify where it’s being used and to update it is on.”

Manjunath Bhat, VP Analyst at Gartner, told Cybersecurity Dive that “the increased threats of malicious code injection as part of supply chain attacks makes it critical to protect open-source software dependencies.”

But protecting applications that are dependent on open source is not easy. Open source projects are often unfunded and under-resourced, so when a problem is encountered, the first problem is getting the vulnerability fixed by the community. The next problem is to try to notify and alert users of the software. And the final problem is for the codebases that use the open-source software to fix or update the problem, be tested, and finally deployed. All of that takes time, time during which the application could be vulnerable to attack.