In our joint webinar with 451 Research, we discussed the key strategies to manage your open source security

1. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved.
New Research Reveals Key
Strategy to Manage Open
Source Security
Scott Crawford, 451 Research
Rami Elron, WhiteSource
October 31, 2018

2. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved. 2
Rami Elron
Senior Director of Product Management
Scott Crawford
Research Director

3. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved.
Questions?
Presentation Slides
Feedback
Housekeeping items
Questions?
A copy of the presentation will be provided to
all attendees
Presentation Slides
Feedback
To ask a question, click on the question button
Don’t forget to leave feedback at the end of
the webinar

4. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved.
An increasingly pervasive
digital world
• Technology becoming
integrated with virtually every
aspect of life
• In industry, as well as in
personal/consumer interaction
• Creating demand as never
before
• What drives tech? Software
2011: “Software is eating the world.”
2016: “Software will program the world.”
-Marc Andreesen
4

5. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved. 5
How to source this demand?
• Internal, bespoke
development can only extend
so far
• The community precedent
• Well established (see Linux)
• Collaborative development
• The rise of shared
repositories
• “Social coding”

6. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved.
Fast forward to today
• Technology now highly
dependent on open source
software (OSS)
• GitHub:
• 28 million developers
• 85 million code repositories
(public and private)
• And now, we can hang a
value on it!
6

7. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved. 7
Not without risks
• Case in point: Licensing
• Open Source Initiative: 83 different
schemes
• Even the definition of “free” may
not always be clear
• What about:
• Sublicenses?
• Software links?
• In development?
• Dynamic links in operations?

8. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved. 8
And then there was…
• Heartbleed
• OpenSSL v1.0.1 (Jan 2012)
• Not discovered & disclosed until
2014
• 17% of secure websites
• ~Half million digital certificates
• …And more (Cisco: 78 different
products affected)

9. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved. 9
The pervasiveness of exposure
• Struts 2 vulnerability
• …which extends the Java Servet API
• …had a vuln in OGNL (remote code
execution exposure)
• …which is incorporated in Jakarta
• …which was part of Apache
• Equifax
• Breach discovered July 29, 2017
• After vuln initially disclosed in March

10. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved. 10
Tackling the challenge:
Software Composition Analysis
• Awareness and action,
before incorporating OSS
risks in critical software
• Licensing
• Identify and clarify
• Security issues
• Discover and track
• Distinctions among versions
• Process integration
• Essential to modern agile,
DevOps environments

11. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved. 11
SCA: Inventory, integration, administration
and coverage
• Track All The Things!
• Development of a Bill of Materials (BOM) from multiple
sources
• Breadth of coverage
• Languages, toolsets
• Action at multiple project stages
• Shifting left …and right
• Today: Containers, too
• Tomorrow: Serverless

12. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved. 12
SCA: Security analysis in depth
• Vulnerability research
• Not just the NVD
• Dependencies
• Vulnerabilities can appear at multiple levels of depth
• Across projects & components
• Organizations are often not aware of these dependencies
• “Effective exposure”
• Vulnerability may or may not face active exposure
• An important consideration in, e.g., failing a build
• Remediation guidance
• Helping to prioritize and deliver

13. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved. 13
SCA: Getting a handle on licensing
• Clarity on actual licenses in use
• Number and prevalence
• In dependencies as well as in primary components
• Non-compliance isn’t necessarily intentional
• Use cases may subject software to licensing that differs from
that declared
• Impact on intellectual property rights
• Factors into, e.g., M&A

14. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved. 14
Organizations are adopting SCA
• In a 2018 451
Research study, 44%
of 190 respondents
surveyed are using
or plan to deploy
Software
Composition
Analysis
Source: 451 Research, Voice of the Enterprise:
Information Security, Workloads and Key
Projects 2018

15. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved. 15
Increase in SCA spending
• 42% of
organizations
reporting SCA in use
or in pilot or POC
plan to increase
their spending on
SCA
Source: 451 Research, Voice of the Enterprise:
Information Security, Workloads and Key
Projects 2018

16. Rami Elron
Senior Director of Product Management, WhiteSource
NEW RESEARCH REVEALS KEY
STRATEGY TO MANAGE
OPEN SOURCE SECURITY

17. Open Source Risk
Is On The Rise

18. 80% of the Code Base is Open Source Components
5%-10%
1998
30%-50%
2008
60%-80%
2016
Proprietary Code
Open Source Code
Source: North Bridge Future Of Open Source Survey

19. Number of Reported Open Source
Vulnerabilities Grew by 51.2% in 2017
Source: WhiteSource Annual Report

20. Risk is Pronounced with Popular Projects
Source: WhiteSource Annual Report
Top 10 Vulnerable Open Source Projects Based on
Number of Vulnerabilities

21. Open Source Security Cost is Rising
Developers spend almost 15 hours per month on open source
security vulnerabilities, on average
1.3%
25.4%
29.8%
26.1%
13.3%
4.1%
None
1 -1 0 hours
11- 20 hours
20-35 hours
36 - 60 hours
Over 60 hours
0.0% 10.0% 20.0% 30.0% 40.0%
Source: WhiteSource Annual Report
Consider this:
Over 40% spend >20 hours per month

22. Open Source Security Cost is Rising
Developers spend almost 15 hours per month on open
source security vulnerabilities, on average
Why is that so?
Lacking tools and practices for practical prioritization
1.3%
25.4%
29.8%
26.1%
13.3%
4.1%
None
1 -1 0 hours
11- 20 hours
20-35 hours
36 - 60 hours
Over 60 hours
0.0% 10.0% 20.0% 30.0% 40.0%
Source: WhiteSource Annual Report
Over 40% spend
>20 hours

23. The Common Way of Handling Security Vulnerabilities
Security teams
analyze and prioritize
vulnerabilities
Sending emails or
opening issues/tickets
Closing the loop on
resolution is hard

24. Bridging the Gap is a Must
Security DevOps Developers

25. Essential Solution Ingredients
Continuous scans
Comprehensive
inventory
Full coverage
Alerts
Early as possible issue
detection

26. The Key Strategy:
Prioritization of Effective Vulnerabilities

27. WhiteSource Software Confidential
? ?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
? ?
?
?
?
?
?
Reported Vulnerabilities
Can you really handle all of them?
Which ones constitute a real risk?
Which ones should be addressed first?
Effective Vulnerabilities
Less to deal with. Much less.vs.
Focusing on Effective Vulnerabilities Could Enable:
Better development efficiency
Better development effectiveness
Better security
The Secret to Prioritization:
Reported Vulnerabilities Are Not Necessarily EFFECTIVE

28. Only some of the reported
security vulnerabilities in open
source libraries are effectively
referenced by developer code.
Ineffective vs. Effective Vulnerabilities
Ineffective
Effective
70%
30%

29. Ineffective vs. Effective Vulnerabilities
Ineffective
Effective
70%
30%
A modern approach to prioritize
security vulnerabilities should be
based on effective impact

30. Q&A

31. 451RESEARCH.COM
©2018 451 Research. All Rights Reserved.
451research.com
Thank you
@s_crawford
@451Research
New York
London
Boston
Washington, D.C.
San Francisco