Open source software is widely used but faces security challenges as vulnerabilities have been found in widely used open source components. While most companies do not currently monitor open source code for security issues, the open source community is adapting to improve security. New approaches for security processes and tools are emerging and will provide increased choices for addressing open source security over time.

1. (In)security in Open Source
Even great approaches to software can have challenges.
The question is how we address them.

2. Open Source is
Massive
Open Source is everywhere
in embedded, mobile and
enterprise computing.
According to the leading
survey of Open Source
market adoption, 43% of
companies find it more
competitive than
alternatives, 43% find it
easier to deploy and 58%
find it has the greatest
ability to scale.
It exists in every sector and
adoption is growing
Reference: Black Duck 2015 Future of Open Source Survey

3. 78%
78% of surveyed companies run on Open Source and less than
3% do not use Open Source in any way.
Reference: Black Duck 2015 Future of Open Source Survey

4. 89%
89% of surveyed companies said that Open Source impacts the
speed of innovation and improves time to market for new
products.
Reference: Black Duck 2015 Future of Open Source Survey

5. What’s the catch?

6. Open Source and Security
There have been significant vulnerabilities discovered in widely
used open source components.
Each was present in applications tested using static and dynamic
tools for years without being detected.
They were disclosed by security researchers conducting manual
code reviews.

7. This Matters

8. This Matters
“Through 2020, security and quality defects
publicly attributed to OSS projects will increase
significantly, driven by a growing presence within
high-profile, mission-critical and mainstream IT
workloads.”
Gartner, Road Map for Open-Source Success: Understanding Quality and Security, Mark Driver, 3 March 2014.

9. This Matters
The DROWN attack left more than 11 million
websites using OpenSSL at risk.
http://thehackernews.com/2016/03/drown-attack-openssl-vulnerability.html

10. This Matters
IoT breaches expose infrastructure like the recent
hack of a bus arrival information screens in Korea
to display pornography.
http://m.chosun.com/svc/article.html?sname=news&contid=2016042601303

11. Open Source Security is
a big deal

12. What Do We Do?
There are a lot of process documentation and tooling options
available for Open Source licensing compliance.
We are only starting to see the emergence of similar process
documentation and tooling for Open Source security.
Actually, most companies do not use any yet.

13. 67%
67% of surveyed companies said that they do not monitor Open
Source Code for security vulnerabilities
Reference: Black Duck 2015 Future of Open Source Survey

14. The Community Evolves
This is obviously not an area that can remain neglected for long.
New connected segments that substantially depend on Open
Source like IoT and Smart Infrastructure mean that we cannot
ignore security any longer.

15. The Community Adapts
The global Open Source community has dealt with improving
processes and tooling before.
The basic approach is to identify the core problems, decide what
needs documenting (processes) and what can be automated
(tooling), and then collaborating to create deliverables.

16. Improved Security in Open Source is Coming
Projects like the Core Infrastructure Initiative at Linux
Foundation have emerged to both explain key processes and
coordinate funding to address security issues.
Vendors and projects around the world are gradually building
tooling to help with Open Source security analysis and
monitoring.

17. Will 2017 be different?

18. Maturity Will Bring Increased Choice
In Open Source license compliance we have a lot of choices
around process documentation or automated tooling.
There is generic process material from FOSS Bazaar, specific
package description material from SPDX, or supply chain
management material from Open Chain. For automated tooling
there are products like the Binary Analysis Tool, Black Duck
Protex or Protocode and community projects like FOSSology.
The same will type of choice will apply to Open Source security.

19. Improved Security in Open Source is Coming
You can expect the emergence of best practices for generic Open
Source security, specific material to address development
problems, and other material to assist with supply chain
challenges.
On the tooling side you can expect the emergence of a range of
solutions to support requirements. We have already seen the
beginning of this from both security vendors and companies that
traditionally focused on license compliance issues.

20. Security
Open Source is no safer or
more dangerous than any
other type of software if
used without good
processes and best practices.
However, if good processes
and best practices are
applied, Open Source has
the potential to be more
secure than anything else.
is what you make of it

21. Open Source has some
security challenges

22. It is still as secure as
proprietary software

23. But it can be
substantially better as
more best practices
emerge

24. You can be part of the
solution