Kill the Contagion
While security researchers work hard to ferret out vulnerabilities ahead of the black hats, the majority of open source developers are not security experts. Many open source code vulnerabilities arise from misconfiguration by end users. The security landscape is full of traps at many levels.
With modern code bases comprising tens of millions of lines of code, automation is key to realizing the benefits of open source hygiene. While human oversight is necessary and helpful in identifying vulnerabilities, effective hygiene comes from orchestrating automated scanning with build engines and continuous integration platforms. With a comprehensive bill of materials (BOM) for an organization's open source code, you can then perform automated scans to supply critical information about security vulnerabilities, licensing conflicts, and version deprecation and proliferation.
Keeping Open Source Code Safe: 5 Tips for the Enterprise
Keeping Open Source Code Safe: 5 Tips for the Enterprise
With more than 4,000 security vulnerabilities reported each year – nearly half of them in open source software – it is imperative to know your code. Enterprises need to continuously monitor open source inventory, detect known vulnerabilities and receive alerts as new vulnerabilities that may impact the business are discovered.
Less than half of the respondents to the Black Duck Software "2015 Future of Open Source" survey reported having adequate policies and procedures in place to assure a secure open source selection and approval process. Without this, enterprises cannot truly know their code and lack the necessary visibility and control of open source to secure and manage their environments.
Black Duck Software conducts nearly 1,000 on-demand code scans each year and every scan identifies open source software that the organization did not know it was using. In this slideshow, Black Duck has identified five tips enterprises should consider when trying to keep open source code safe.
