OpenChain Webinar - Open Source Due Diligence for M&A - 2024-06-17
0 likes250 views
The document discusses the importance of Open Source Due Diligence (OSDD) in mergers and acquisitions, highlighting the significant risks associated with open source software, including licensing and cybersecurity risks. It outlines a structured approach for conducting OSDD, which includes preparation, source code audits, and post-acquisition integration, emphasizing the necessity of thorough investigation to ensure informed decision-making and risk mitigation. Ultimately, the process aims to identify issues, confirm values, and plan for effective remediation in the context of M&A transactions.
OpenChain Webinar - Open Source Due Diligence for M&A - 2024-06-17
- 1. OPEN SOURCE DILIGENCE: FROM RISK ASSESSMENT TO POST-CLOSE INTEGRATION JARI KOIVISTO 2024-06-17
- 2. SPEAKER Jari Koivisto Open Source Specialist
- 3. AGENDA 1 OPEN SOURCE DUE DILIGENCE (OSDD) • WHY IT IS IMPORTANT FOR M&A 2 OPEN SOURCE DUE DILIGENCE IN PRACTICE 3 OSDD SPECIALISTS’ ROLE AT POST-CLOSE 4 SUMMARY
- 4. OPEN SOURCE DUE DILIGENCE WHAT IS OSDD AND WHY IT IS IMPORTANT FOR M&A
- 5. OPEN SOURCE DUE DILIGENCE IS IMPORTANT FOR TECH M&A SOFTWARE DEVELOPMENT AND RISK TODAY • TODAY ALMOST 80% OF CODE BASES ARE OPEN SOURCE SOFTWARE, SEE SYNOPSYS' 2024 OPEN SOURCE RISK IN M&A BY THE NUMBERS REPORT FOR DETAILS • MANY POTENTIAL TARGET COMPANIES DO NOT MANAGE OSS WELL → UNKNOWN RISKS IN M&A • OPEN SOURCE DISCLOSURE LISTS THAT TARGETS PROVIDE ARE NORMALLY FAR FROM COMPLETE • ALL OPEN SOURCE CODE HAS POTENTIAL LICENSING AND CYBER SECURITY RISKS • LICENSING RISK: TARGET’S IP MAY BE AT RISK – ONCE INTEGRATED EVEN THE BUYER’S IP MAY BE AT RISK • CYBER SECURITY RISK: DATA BREACHES CAN BE VERY EXPENSIVE Source: 2024 Open Source Risk in M&A by the Numbers
- 6. OPEN SOURCE DUE DILIGENCE IS IMPORTANT FOR TECH M&A INFORMS THE DEAL AND FUTURE PLANS • IDENTIFY IF THERE ARE ANY MAJOR SURPRISES • HOWEVER, IT IS LESS ABOUT KILLING THE DEALS – BUT THAT CAN HAPPEN TOO, IF RISKS AND/OR MITIGATION COSTS ARE TOO HIGH • MANY CRITICAL/MAJOR ISSUES MAY ALSO AFFECT DEAL TERMS AND EVEN VALUATION • ESTIMATE HOW MUCH TIME AND MONEY IS NEEDED TO MITIGATE ISSUES AND INTEGRATE • HIGH CRITICALITY RISKS ARE OFTEN MITIGATED BEFORE THE DEAL CLOSES
- 7. Licensing risks •OSS Licenses have obligations that one needs to fulfill •Even permissive licenses •Components without license •E.g. Target: “We did not find any license, so we assumed that the code was public domain.” Security risks •Are there known vulnerabilities (CVEs) •According to 2024 Open Source Risk in M&A by the Numbers: • 97% of transactions contained at least one vulnerability, mean 439 vulnerabilities per transaction •94% of transactions involve code with high-risk vulnerabilities •Exploitable or not? •E.g. vulnerable only if used in 32-bit platform and Target only uses 64-bit platforms •Does Target have processes to identify and remediate security issues? Buyer to know what they are buying •Without a good Open Source DD, Buyer may spend millions/billions on something that they need to open source •E.g. OpenWrt •Is the price correct? Buyer to understand what it takes to mitigate issues •Validating Roadmap •High-risk issues → closing conditions •E.g. embedded copyleft code Open Source Due Diligence for M&A Identifying Issues Confirming Value Planning
- 8. OPEN SOURCE DUE DILIGENCE IN PRACTICE A TESTED PROCESS OF HOW TO EXECUTE OSDD FOR M&A
- 9. OPEN SOURCE DUE DILIGENCE EXECUTION APPROACHES • The goal is to find out how and how well OSS component use is managed Questionnaires and meetings • The goal is to get an understanding of the risk level • Licensing risk • Cyber security risk • Verify how effective the OSS management is • Target may have an excellent OSS Policy and training on paper, but if not put into use, those have no value • Are the codebase findings in line with the questionnaire answers? Source code audit
- 10. PREPARE BEFORE THE ACTUAL DUE DILIGENCE WORK STARTS SUCCESSFUL DD REQUIRES GOOD PREPARATION • EARLY ENOUGH: • PREPARE QUESTIONNAIRE(S) AND CHECKLIST(S) • SELECT THE 3RD PARTY AUDITOR, AGREE ON BUSINESS TERMS • AGREE ON WHO IS THE CONTACT POINT FOR THE TARGET • TARGET PERSONNEL WILL BE VERY BUSY AND HAVING A SINGLE PERSON CONTACT MAKES THEIR LIFE EASIER • ONCE THE TARGET IS KNOWN: • STUDY TARGET’S OFFERING • BUSINESS UNIT’S PLANS
- 11. OPEN SOURCE DUE DILIGENCE TIMELINE Scoping Planning and Priority Negotiate Open Source Due Diligence will take time. Agree on what products and versions need to be audited. Review issues, prioritize and create remediation plans. Some high-priority issues remediated normally pre-close. Be prepared to negotiate. Buyer to reassess deal terms.
- 12. OPEN SOURCE DUE DILIGENCE PROCESS OBSERVATIONS • BUYER WANTS TO UNDERSTAND TARGET’S: • OPEN SOURCE POLICIES AND PROCESSES • TRADITIONALLY OPEN SOURCE LICENSE COMPLIANCE WAS THE MAIN FOCUS • TODAY ADDITIONAL FOCUS ON OPEN SOURCE MANAGEMENT PROCESSES AND OPEN SOURCE VULNERABILITIES • BUYER DOES NOT HAVE ACCESS TO THE SOURCE CODE • BUYER DOES NOT WANT TO SEE THE SOURCE CODE • TARGET DOES NOT WANT TO SHARE THEIR SOURCE CODE • IN THE END OPEN SOURCE DUE DILIGENCE PRODUCES • OPEN SOURCE RISK REPORT • MITIGATION PLAN, WHICH INCLUDES ESTIMATES OF COST (TIME / MONEY) 3rd party auditor often the answer
- 13. OPEN SOURCE POLICIES AND PROCESSES BUYER TO EXAMINE THE QUALITY OF TARGET’S OPEN SOURCE POLICIES AND PROCESSES • NORMALLY NOT MUCH TIME → THE QUICKEST WAY IS TO USE A QUESTIONNAIRE AND A MEETING WITH TARGET • BUYER SHOULD ALSO REQUEST A DISCLOSURE LIST (SBOM) OF ALL 3RD PARTY COMPONENTS • GOOD INDICATOR OF TARGET’S PROCESSES • E.G. ONCE THE DISCLOSURE LIST HAD 7 ITEMS AND THE CODE BASE WAS PRETTY LARGE AND THE CODE AUDIT FOUND AT LEAST HUNDREDS OF COMPONENTS AND SNIPPETS • TIPS: • KEEP THE QUESTIONNAIRE AS SHORT AS POSSIBLE, BUT INCLUDE ALL RELEVANT AND IMPORTANT QUESTIONS • THERE ARE PUBLICLY AVAILABLE CHECKLISTS THAT CAN BE USED AS A STARTING POINT FOR THE QUESTIONNAIRE(S) • SEND THE QUESTIONNAIRE TO TARGET AS SOON AS POSSIBLE AND GIVE THEM A COUPLE OF DAYS TO ANSWER
- 14. WHAT SHOULD BE EXPLORED BASED ON THE QUESTIONNAIRE(S) AND MEETINGS WITH TARGET • DOES TARGET HAVE A WRITTEN OPEN SOURCE POLICY? • IF YES, HOW IT COMPARES TO BUYER’S OPEN SOURCE POLICY • POLICIES AND PROCESSES FOR OSS USE AND CONTRIBUTING BACK TO THE OSS PROJECTS • DOES TARGET HAVE AN OPEN SOURCE COMPLIANCE PROGRAM, OSPO, OSRB? • POLICIES AND PROCESSES HANDLING KNOWN VULNERABILITIES (CVES) • POLICIES AND PROCESSES FOR OUT-OF-SUPPORT OR DEPRECATED OSS COMPONENTS • WHAT TOOLS TARGET USES • SCA, SBOMS MANAGEMENT, VULNERABILITIES MANAGEMENT • OPENCHAIN CERTIFIED? • ISO 5230 CONFORMANT? AND/OR ISO 18974 CONFORMANT?
- 15. SOURCE CODE AUDIT USING 3RD PARTY AUDITOR • TYPICALLY TARGET’S SOURCE CODES DELIVERED TO THE AUDITOR • AUDITOR CAN ALSO GO TO TARGET’S SITE OR HAVE A PROXY LAPTOP THERE • SNIPPET-LEVEL AUDIT RECOMMENDED • COPYLEFT SNIPPETS IN TARGET’S IP • E.G. CC-BY-SA SNIPPETS FROM STACKOVERFLOW VERY COMMON • GPL AND OTHER COPYLEFT SNIPPETS ALSO POSSIBLE • AI-GENERATED CODE SNIPPETS NEED TO BE PROPERLY HANDLED TOO • COPYRIGHTS, ATTRIBUTIONS, LICENSE TEXTS? • COPYLEFT? * Snippet level scan & audit recommended Start Term-sheet Kick-off call Project start, introduce 3rd party auditor and Target, details of the audit. Target delivers the code to the auditor Typically auditor sets up a secure server for Target to upload the source code. The auditor executes the audit Machine scan on the code base. Identify the origin and licenses of Open Source components and snippets*. Identify also components and snippets* without any license. Audit report delivery The auditor delivers the report(s) to the buyer, the report includes the SBOM and a summary of the findings. Known vulnerabilities report may also be part of the delivery. Final meeting The auditor presents the findings of the audit and addresses any additional questions. End
- 16. EXPECTATIONS START-UP (TYPICAL TARGET): • MAY NOT HAVE WRITTEN OPEN SOURCE POLICY, BUT LIKELY HAVE PROCESSES TO ACCEPT/REJECT OPEN SOURCE COMPONENTS, E.G. ASK THE CTO • MAYBE A CODE SCAN BEFORE THE DUE DILIGENCE AS PART OF THE PREPARATION, BUT OFTEN SCANS ARE NOT PART OF THE WORKFLOW • AUDIT FINDINGS: • A LOT OF FINDINGS, BUT MOSTLY PERMISSIVE LICENSES • ALSO CC-BY-SA LICENSED SNIPPETS • CVES, (OUTDATED COMPONENTS) MATURE COMPANY: • OPEN SOURCE POLICY AND PROCESSES IN PLACE • LICENSE COMPLIANCE IS TAKEN CARE OF, SOME MAY EVEN HAVE A VIRTUAL OSPO OR OSPO • AUDIT FINDINGS: • ALWAYS SOMETHING → TARGET OFTEN PRO- ACTIVELY REMEDIATES • CC-BY-SA LICENSED SNIPPETS • CVES, OUTDATED COMPONENTS
- 17. OPEN SOURCE DUE DILIGENCE PRODUCES REPORTS AND REMEDIATION PLANS • OSS LICENSE COMPLIANCE ISSUES REPORT • OSS SECURITY ISSUES REPORT • POSSIBLY PART OF THE OVERALL SECURITY DUE DILIGENCE AUDIT REPORT • REMEDIATION PLAN(S) • HOW TO REMEDIATE OSS LICENSE COMPLIANCE ISSUES • HOW TO REMEDIATE CURRENT OSS KNOWN VULNERABILITIES • PROCESSES IMPROVEMENT PLANS • TARGET OSS TRAINING PLANS • ISSUES REMEDIATION PLANNING: TARGET KNOWS THE CODE THE BEST → KEEP THEM IN THE LOOP AND ASK FOR SUGGESTIONS AND TIMELINES Remove Replace Rewrite Renew Relicense Respect
- 18. TAKING ADVANTAGE OF THE OPEN SOURCE DUE DILIGENCE RESULTS POST- CLOSE THE ONES WHO EXECUTED THE OSDD HAVE THE BEST KNOWLEDGE
- 19. ACQUISITION INTEGRATION DEPENDING ON THE INTEGRATION SCENARIO • ACQUISITION INTEGRATION STARTS AFTER THE DEAL CLOSES • AT THE BEGINNING THE ACQUISITION INTEGRATION PEOPLE HAVE LIMITED KNOWLEDGE OF THE TARGET • PEOPLE WHO CONDUCTED THE OPEN SOURCE DUE DILIGENCE AND PRODUCED THE REPORTS AND REMEDIATION PLANS HAVE THE LATEST INFORMATION • THINGS TO CONSIDER: • DO NOT THROW THE OPEN SOURCE DUE DILIGENCE REPORTS AND REMEDIATION PLANS OVER THE FENCE TO ACQUISITION INTEGRATION AND HOPE FOR THE BEST • A GOOD PRACTICE IS THAT PEOPLE WHO CONDUCTED THE OPEN SOURCE DUE DILIGENCE HELP THE ACQUISITION INTEGRATION AND BUSINESS UNIT AT LEAST AT THE BEGINNING OF THE INTEGRATION PHASE • OSDD SPECIALISTS TO PARTICIPATE IN THE FIRST INTEGRATION MEETINGS • SOMETIMES JUST 1-2 MEETINGS ARE NEEDED, SOMETIMES SEVERAL MEETINGS OVER THE MONTHS ARE NEEDED
- 20. ACQUISITION INTEGRATION OPEN SOURCE DUE DILIGENCE SPECIALISTS’ ROLE • GO THROUGH THE OPEN SOURCE DUE DILIGENCE AUDIT REPORT(S): • EXPLAIN THE ISSUES AND SUGGESTED REMEDIATION ACTIONS • ISSUES MAY BE IN OSS LICENSING, OSS VULNERABILITIES, PROCESSES, ETC. • ANSWER ANY QUESTIONS (BUSINESS UNIT, OSPO/BU LEGAL, ACQUISITION INTEGRATION) • NEW INFORMATION ACQUIRED • DURING THE FIRST WEEKS AND MONTHS OF INTEGRATION MORE INFO IS GATHERED • SOME REMEDIATION RECOMMENDATIONS NEED ADJUSTING OR POSSIBLY SOME ISSUES NO LONGER ARE ISSUES • OPEN SOURCE DD SPECIALIST CAN HELP THE ACQUISITION INTEGRATION TEAM AND BUSINESS UNIT • BUSINESS UNIT PLANS CHANGED? • IN CASE BU CHANGES THE PLANS POST-CLOSE → OPEN SOURCE ISSUES MAY BE DIFFERENT • E.G. SAAS SOLUTION → SHIPPED SOLUTION
- 21. WHAT IF FULL OPEN SOURCE DUE DILIGENCE CANNOT BE DONE PRIOR DEAL CLOSE? • NO TIME TO DO FULL OSDD PRIOR TO THE DEAL’S LEGAL CLOSE? • CONTINUE THE AUDIT POST-CLOSE • OPTIONS TO HAVE: • ESCROW • REPS/WARRANTIES • NOWADAYS MORE INSURERS IN THIS SPACE
- 22. SUMMARY
- 23. OPEN SOURCE DUE DILIGENCE PROCESS AN EXAMPLE OF HOW THE WHOLE PROCESS MAY LOOK LIKE Preparation •Questionnaire(s) ready •3rd party auditor selected •Information about the Target and its products •Publicly available info Start •Term-sheet agreed •OSDD starts OSDD kick-off call •Buyer •Target •3rd party auditor •Legal representatives Code audit •Open Source questionnaire(s) to Target •Request disclosure list (SBOM) •3rd party code audit starts Target’s response to initial questionnaire(s) •Answers to the questions •Disclosure list (SBOM) 3rd party code audit •A snippet-level audit will take some time •The auditor delivers the code audit report Code audit follow-up •Buyer – Auditor meeting •Additional questions based on the Audit report to the Target •(Meeting with Target) Target’s responses to the Additional questions •Questionnaire based on the Audit report Risk evaluation •Interim Report and Interim Remediation Plan •Inputs to Final Commit Final Commit •Normally Public announce follows Remediation planning •Final OSDD report(s) •Final Remediation Plan(s) Deal Legal Close •Target part of the Buyer now Due Diligence closure •Hand-off to Acquisition Integration Acquisition Integration •Open Source DD specialist consults Acquisition Integration •Issues remediated •Target integrated into the Buyer’s organization
- 24. SUMMARY • OPEN SOURCE DUE DILIGENCE VERY IMPORTANT FOR M&A • PREPARE ALL QUESTIONNAIRES AND SELECT 3RD PARTY AUDITOR WELL IN ADVANCE • TWO MAIN TRACKS IN OSDD: 1. QUESTIONNAIRE(S) AND MEETINGS 2. SOURCE CODE AUDIT (BY 3RD PARTY AUDITOR) • OPEN SOURCE PRACTICES AND PROCESSES ANALYSIS • SOURCE CODE AUDIT: LICENSING AND SECURITY RISKS ANALYSIS • COST (TIME / MONEY) OF ISSUES REMEDIATION • PEOPLE WHO CONDUCTED OSDD TO PARTICIPATE IN ACQUISITION INTEGRATION • A MEETING OR TWO AND IF NEEDED FOR LONGER
- 26. CONTACT INFO JARI KOIVISTO • jari.p.koivisto@iki.fi • https://www.linkedin.com/in/jarikoivisto/