{"id":8386,"date":"2018-05-22T07:00:05","date_gmt":"2018-05-22T15:00:05","guid":{"rendered":"http:\/\/formtek.com\/blog\/?p=8386"},"modified":"2018-03-30T09:00:54","modified_gmt":"2018-03-30T17:00:54","slug":"security-and-open-source-open-source-components-save-time-but-need-to-be-closely-monitored","status":"publish","type":"post","link":"https:\/\/formtek.com\/blog\/security-and-open-source-open-source-components-save-time-but-need-to-be-closely-monitored\/","title":{"rendered":"Security and Open Source: Open Source Components Save Time but Need to be Closely Monitored"},"content":{"rendered":"

Is Open Source code vulnerable?\u00a0 Open Source code is very widely used.\u00a0 Typically software code bases consist of anywhere from 75 percent to 90 percent of open source<\/a>.\u00a0 The problem is that those dependencies are usually black boxes that developers have not had the time to carefully inspect.\u00a0 Developers typically forget about which open source utilities they’ve used and move on to their next task or project.\u00a0 They also seldom have the time to monitor updates of the open source components that they’re using in their projects.\u00a0 That’s particularly troubling when missed updates contain security fixes, and without those fixes, businesses\u00a0 unwittingly become exposed to vulnerabilities.<\/p>\n

Chris Wysopal<\/a>, CTO of Veracode, said that<\/a> “the universal use of components in application development means that when a single vulnerability in a single component is disclosed, that vulnerability now has the potential to impact thousands of applications \u2013 making many of them breachable with a single exploit.”.<\/p>\n

Wysopal said “development teams aren\u2019t going to stop using components \u2013 nor should they. But when an exploit becomes available, time is of the essence. Open source and third party components aren\u2019t necessarily less secure than code you develop in-house, but keeping an up-to-date inventory of what versions of a component you are using. We\u2019ve now seen quite a few breaches as a result of vulnerable components and unless companies start taking this threat more seriously, and using tools to monitor component usage, I predict the problem will intensify.”<\/p>\n

GitHub<\/a>, for example, recently scanned about one half million open source repositories that they host and uncovered more than four million vulnerabilities!\u00a0 The repository owners were notified, and within the next two months, 450,000 of those vulnerabilities were resolved. GitHub is now scanning all new repository updates to check for security problems and update their owners if any problems are found.<\/p>\n

\"Digg<\/a><\/div>
\"Reddit<\/a><\/div>
\"Stumble<\/a><\/div>
\"Buzz<\/a><\/div>
\"Vote<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Kick<\/a><\/div>
\"Shout<\/a><\/div>
\"Share<\/a><\/div>
\"Bookmark<\/a><\/div>
\"Post<\/a><\/div>
\"Google<\/a><\/div><\/div>","protected":false},"excerpt":{"rendered":"

Is Open Source code vulnerable?\u00a0 Open Source code is very widely used.\u00a0 Typically software code bases consist of anywhere from 75 percent to 90 percent of open source.\u00a0 The problem is that those dependencies are usually black boxes that developers…<\/span><\/p>\n

Read more ›<\/a><\/div>\n

<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[24,31],"tags":[],"class_list":["post-8386","post","type-post","status-publish","format-standard","hentry","category-open-source","category-security"],"_links":{"self":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/8386","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/comments?post=8386"}],"version-history":[{"count":1,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/8386\/revisions"}],"predecessor-version":[{"id":8387,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/posts\/8386\/revisions\/8387"}],"wp:attachment":[{"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/media?parent=8386"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/categories?post=8386"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/formtek.com\/blog\/wp-json\/wp\/v2\/tags?post=8386"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}