Open Source: No Longer a Fringe Movement, But Security is a Worry

It’s taken decades, but Open Source software has moved from a fringe weird idea into mainstream software development and is routinely used in both small and large businesses. [In 2010, the Wall Street Journal wrote of an “open-source software movement, whose activists tend to be fringe academics and ponytailed computer geeks.”]

Donald Fischer, chief executive officer at Tidelift, said that “open source is now the de facto standard application development platform and is a proven driver of business success and innovation. Yet as its popularity grows, the challenge of helping development teams manage open source health and security becomes exponentially more difficult.”

Jim Mercer, IDC analyst, pinpointed a major problem with open source, saying that “despite the litany of different projects used for building applications, there are no established standards for building, maintaining, and securing OSS. Unfortunately, because many OSS projects are underfunded or rely solely on volunteer contributors, there is a lot of variation in how the projects are maintained.”

The lack of oversight and the need for continued and guaranteed maintenance on many open source projects is a reason for concern. A survey by Synopsys found deep worry about Open-Source usage among IT. The Synopsys survey found that while 99 percent of companies either use or plan to use Open Source soon, 41 percent worry about being hacked because of their open source choice.

Jason Schmitt, general manager at Synopsys, said that “as organizations are witnessing the level of the potential impact that a software supply chain security vulnerability or breach can have on their business through high-profile headlines, the prioritization of a proactive security strategy is now a foundational business imperative.”

One solution proposed by analyst firms like Gartner and IDC is to use a centrally managed repository of open-source components that are available for use by developers in an organization. Chris Grams, head of marketing at Tidelift, said that “I would view this as an emerging trend. It’s interesting to see that we’re still [in the] early days, but some organizations are starting to do this.” But it is unlikely that this model would work for most companies — it would require a dedicated team to select, validate, and maintain a curated set of open-source components, and even then, if vulnerabilities are ultimately found within those components, the skillset needed to fix the problem is likely outside the realm of the organization.