Security Vulnerabilities in Open Source Software

By Preethy Soman, IBM Market Segment Manager. Originally published as “As a consumer of Open Source Software, what are your worries on security vulnerabilities?” on Quora.

As open source code becomes more prevalent in commercial and home-grown applications, the number of attacks based on its vulnerabilities is also expected to increase. While Open Source software offer many benefits to development teams, it can pose significant risks to your organization. Since open source code is widely-deployed, attackers can pursue a large number of targets with the same exploit. Because of the difficulties associated with keeping track of open source code, users frequently don’t deploy patches and updates, making it easy for hackers to take advantage of known vulnerabilities.

In their continual rush to release, developers often don’t check open source code for vulnerabilities, or suspect that there are problems and use it anyway. Hence, unpatched vulnerabilities still have the ability to hang around, while new code can be written with old, known vulnerabilities already built in. The Common Vulnerabilities and Exposures (CVE) database shows hundreds of security vulnerabilities that are directly related to open source libraries.

Certain open source communities are quicker to fix and upgrade their code base (sometimes as often as 5 or 6 times a year). Unfortunately, developers who do not always monitor these discoveries and updates would not know of many of the vulnerabilities that are housed in the communities, and they would clearly not prioritize upgrading the versions of the libraries that they use.

To address security challenges effectively, organizations should take a strategic approach to implementing comprehensive application security programs. Just like in any other area of security, identifying vulnerabilities and effectively managing them represents the highest priority. Failing to fix known software vulnerabilities is a big reason why organizations face data hacks and breaches.

With IBM Security Open Source Analyzer, you can gain control and visibility over your open source risk by continuously identifying vulnerable open source components in your software. Open Source Analyzer is a key component of IBM’s Application Security on Cloud solution. Open Source analyzer permits you to:

• Automatically discover Open Source packages in your code
• Identify those packages with vulnerabilities
• Provide actionable remediation suggestions
• Automate Security testing and configure your scanning activity

Consult our recent blog to learn more about the critical importance of open-source application security testing, and check out our cool video to learn how you can stay “one step ahead” of potential attackers by implementing an effective open-source testing program at your organization. You can also register for a complimentary trial and test-drive IBM Application Security on Cloud today.

Any information IBM provides is not legal advice.

By Preethy Soman, IBM Market Segment Manager. Originally published on Quora.

For more trending tech answers from Quora, visit HackerNoon.com/quora.