Cybersecurity Risks for Open Source Code | SPONSORED
The adoption of open source code has increased exponentially over the past decade, with a large percentage of commercial software now containing it. Developers are constantly sharing common features and code functionality across the internet and globe. The speed and demand placed upon application teams is high – business used to run via application releases a handful of times per year, and now is done a handful of times per week or day. This rapid acceleration pushed the world to move from “waterfall” and “iterative” project methodologies to “agile” to meet the rapidly growing demand. But what are the cybersecurity risks associated with open source code and how to protect it?
Open Source Cybersecurity Risks
- Vulnerabilities – average of 64 vulns per code base. 1500+ days before a fix. Development processes are your first line of defense.
- You build it, you own it
- Software of unknown origin
- Continuous monitoring of config and environment
To mitigate the risks, usage of Open Source repository scanning technologies is mandatory. A service which is able to find manifest files (identify and analyze), understand the direct and indirect dependencies (and flag them for known vulnerabilities) is a must. Having integration into your code repository also helps identify your risks tied to your projects. Then building the issue findings into your ticketing system (or creating pull requests) for remediation, at the developer level, is the next step to ensure the code has ownership and is cared for during its lifecycle. Maintenance and auditing (remediation) of this will be required because every time the same pull request happens, as scan and updated patch request must occur there too.
Building a culture among your organization to have ownership of code, the maintenance of it, and pride in the application from release to release will take time. It is paramount to making Open Source more secure though, as the ownership and pride will help keep it secure. Implementing the technology checks on top will assist in keeping the teams involved and more secure, as will doing this continuously.
More about Cybersecurity Vulnerabilities in ICS Mobile Applications
Read the full post on open source software security from Trend Micro to learn 4 best practices to mitigate vulnerabilities.
About the Author
Aaron Ansari
VP, Cloud Security at Trend Micro
Data Retention for Long-Term IIoT Monitoring Using Time Series Databases
Traditional industries have evolved by implementing many Industrial IoT practices, where we can get data from mechanical devices and sensors. Such real-time data monitoring helps perform better analysis, predict equipment failure, and reduce operating costs. However, IIoT creates enormous volumes
Securing the Perimeter: Cybersecurity at the Edge for OT LAN and Edge Networks
Industrial cybersecurity is a critical focus area for the manufacturing sector, where legacy systems and digital transformation collide. This session, featuring experts from Fortinet, Orange Business, Enfo CyberSec, and Honeywell, explores solutions to secure OT (Operational Technology) networks and protect critical infrastructure. Challenges in
Predictive Maintenance in IIoT: Leveraging Time Series Data for Equipment Longevity
The industrial Internet of Things (IIoT) helps bind machines, sensors, and systems together. They form a network of intelligent devices working together to generate and share data. This approach to managing devices has revolutionized how industries manage, monitor, and maintain