How Secure Are Your Open Source Software?

Welcome to AppSec Unlocked, the podcast that demystifies application security one episode at a time. My name is Edwin Kwan and I'm your host for today, and we're diving into a critical question: "How Secure Is Open-Source Software?" Get ready for an eye-opening episode that could change the way you think about the building blocks of modern applications.

---

The Open-Source Paradox

Open-source software is the backbone of modern applications. From web frameworks to encryption tools, these readily available components offer developers a wealth of functionality and accelerate development cycles. But as we've discussed in previous episodes, you're probably using more open-source than you realize, and that convenience comes with hidden costs and potential security vulnerabilities. If you haven't checked out our episodes on "You're Using More Open-Source Than You Realize" and "Why Your Applications Need a Software Bill of Materials," I highly recommend giving those a listen. You can find links in our show notes.

The Security Controls Gap

Let's start by looking at the security controls most organizations have in place for their in-house code. It's typically a multi-layered approach:

1. Secure Development Environment: This includes endpoint protection, two-factor authentication, and restricted administrative privileges.

2. Developer Training: Organizations invest in training developers on secure coding practices, like the OWASP Top 10.

3. Rigorous Testing: This includes unit testing, integrated and regression testing, and practices like Test-Driven Development (TDD).

4. Change Control: Code reviews and mandatory pull requests help catch security flaws before code hits production.

These controls create a secure development environment for in-house code. But does open-source software benefit from the same level of scrutiny?

The Open-Source Enigma

The open-source community thrives on collaboration and transparency. However, this very nature presents some unique security challenges:

1. Variable Security Practices: Open-source projects often lack the resources to implement rigorous security practices found in commercial environments.

2. Volunteer Dependence: Security expertise within open-source projects can be scarce, with vulnerabilities relying on the community to identify and patch.

3. Motivation Mismatch: The activities required to create secure projects, such as careful testing and code reviews, might not be as exciting or motivating to volunteers.

Let me share some sobering statistics from the State of Software Supply Chain report:

• Only 19% of open-source projects perform code reviews.

• A staggering 18.6% of open-source projects were abandoned last year!

These factors make it difficult to guarantee a consistent level of security in open-source software.

The Due Diligence Disparity

Now, let's talk about the elephant in the room: the disparity in due diligence between procured commercial software and open-source components. When organizations buy commercial software, they typically:

• Send security questionnaires

• Conduct penetration testing

• Scrutinize vendor security practices

• Perform thorough contract reviews

But when it comes to open-source software, the approach is often much less stringent. Many organizations simply download open-source components without thoroughly investigating their security posture, relying on the software's popularity as a proxy for security. There's also the challenge of version control. Keeping track of the latest secure versions of open-source software can be a complex task, often resulting in outdated and vulnerable versions lingering in projects. This disparity in due diligence exposes organizations to significant security risks when using open-source software.

The Cost of Insecure Open Source: A Walk Down Memory Lane

Let's take a moment to reflect on some major security breaches caused by vulnerabilities in open-source libraries:

1. The Equifax Breach (2017): A critical vulnerability in the Apache Struts framework remained unpatched, allowing attackers to steal personal information of over 143 million people.

2. The SolarWinds Supply Chain Attack (2020): Attackers compromised the popular SolarWinds Orion library, injecting malicious code that infiltrated numerous government agencies and private companies.

3. The Spring4Shell Vulnerability (2022): A critical vulnerability in the widely used Spring Core Java framework exposed applications to remote code execution attacks.

These breaches highlight the potentially devastating consequences of using insecure open-source libraries.

Best Practices for Secure Open-Source Usage

So, how can we harness the power of open-source while mitigating the risks? Here are some best practices:

1. Implement a Software Bill of Materials (SBOM): Keep track of all open-source components in your applications.

2. Use Software Composition Analysis (SCA) tools: These can help identify known vulnerabilities in your open-source dependencies.

3. Establish an open-source policy: Define guidelines for selecting, using, and maintaining open-source components.

4. Contribute back to the community: By actively participating in open-source projects, you can help improve their security.

5. Keep dependencies up-to-date: Regularly update your open-source components to ensure you have the latest security patches.

6. Perform your own security assessments: Don't rely solely on the open-source community. Conduct your own security reviews of critical components.

---

 So, how secure is open-source software? The answer, as with many things in security, is "it depends." Open-source doesn't have to be a security gamble. With the right strategies and a proactive approach, it can be a powerful tool for building secure and innovative software. Remember, the key is awareness and active management. Know what open-source components you're using, understand their security implications, and take steps to mitigate the risks. Thank you for tuning in to AppSec Unlocked. This is your host Edwin Kwan, and remember: in the world of application security, what you don't know can hurt you. Stay curious, stay vigilant, and keep unlocking those AppSec mysteries. Until next time!