COMMENTARY: Open-source software (OSS) has become the backbone of modern digital infrastructure, and for good reason. It cuts development costs, offers flexibility and customization, and fosters innovation because of its collaborative nature. Its adoption grows in lockstep with today’s advancements in AI and cloud technologies that often rely on the OSS paradigm.
However, the benefits eclipse the fact that open-source carries a serious risk: dependencies and the supply chain are not always under the organization’s control.
[SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Read more Perspectives here.]
A vulnerability in a single dependency can have a domino effect across the whole software stack. With suboptimal maintenance of many such projects, unpatched vulnerabilities can stick around in the codebase indefinitely. Malware injection by a third-party represents a flip side to the open nature of OSS, making malicious packages cascade through numerous projects that harbor these poisoned dependencies.
According to a recent report from Synopsys, out of 936 codebases that underwent risk assessments in 2023, 84% had vulnerabilities. High-risk security gaps were found in a staggering 74% of these codebases. The mean age of the loopholes was 2.8 years, and 14% were older than a decade.
Pair these eyebrow-raising stats with the fact that open source has emerged as the foundation of more than 90% of applications globally, and it’s clear that incidents fueled by open-source software imperfections have become a serious problem.
The wake-up call was the Heartbleed Bug from 2014 that affected the OpenSSL cryptographic library and let attackers steal sensitive information like passwords and encryption keys from the memory of compromised servers. The Log4j vulnerability (Log4Shell) first hit the headlines in 2021 as a potential catalyst for remote code execution on millions of servers and devices worldwide. A memory corruption bug found in the XZ Utils data compression toolkit earlier this year offered threat actors backdoor access to numerous Linux distributions.
What to do about it
The impactful incidents highlight how open-source software, while vital to innovation, can become a liability if not carefully monitored and shielded. As dependencies grow, so does the complexity of the attack surface. This makes it crucial for organizations to implement robust open-source security strategies throughout the software lifecycle. Let’s look at some of the best practices in this area:
OSS holds great promise as the mainstay of the global software environment for years to come, but its flexibility and accessibility also introduce tangible challenges. The future of OSS security lies in collaboration, innovation, and an unwavering commitment to best practices, so it’s in the organization’s best interest to stay ahead of the curve.
David Balaban, owner, Privacy-PC
SC Media Perspectives columns are written by a trusted community of SC Media cybersecurity subject matter experts. Each contribution has a goal of bringing a unique voice to important cybersecurity topics. Content strives to be of the highest quality, objective and non-commercial.
