Tackling the Risks of Open Source Security: 5 Things You Need to Know
0 likes69 views
This document discusses open source security risks and provides recommendations. It contains 5 sections: 1. Open source risk is on the rise as open source code accounts for 60-80% of software and reported vulnerabilities are increasing. 2. Developers must change their mindset as open source vulnerabilities differ from proprietary vulnerabilities in detection, publicity and remediation. 3. Prioritizing security vulnerabilities is key as developers spend too much time on ineffective vulnerabilities. 4. Security responsibilities must be delegated between security, DevOps and developers to bridge gaps. 5. Shifting security left by empowering developers and integrating tools earlier can turn developers into advocates and detect issues cheaper.
Tackling the Risks of Open Source Security: 5 Things You Need to Know
- 1. Tackling the Risks of Open Source Security 5 Things You Need to Know 1 Sharon Sharlin, Product Marketing Manager
- 2. 2 5 Things To Know About Open Source Security 01 Open Source Risk Is On The Rise 03 Prioritize Security Vulnerabilities 02 It’s Time To Change Your Mindset 04 Delegate Security Responsibilities 05 Shift Left Is At Its Best With Open Source
- 3. 3 01 Open Source Risk Is On The Rise
- 4. 4 Are You Spending Enough In AppSec? The Level of Risk (# of Breaches Multiplied By Severeness) The Level of Annual Spending (Investment) in IT Security Gaps in Security Risks and the Allocation of Spending Source: Ponemon Institute: The Increasing Risk to Enterprise Applications
- 5. Open Source Components Account For 60%-80% Of The Average Software Product 5%-10% 1998 30%-50% 2008 60%-80% 2018 Proprietary Code Open Source Code Source: North Bridge Future Of Open Source Survey Open Source Code Proprietary Code
- 6. 96.8% of developers rely on open source components Frequency of Use of Open Source Components
- 7. The Number of Reported Vulnerabilities is Rising
- 8. 8 02 It’s Time To Change Your Mindset
- 9. Potential vulnerability detected (SAST & DAST) No public information Need to research to find a fix During development Detection Publicity Remediation Scan Phase Known vulnerability All information is publicly available Actionable remediation(s) are available Continuous monitoring (incl. post release) PROPRIETARY VULNERABILITIES OPEN SOURCE VULNERABILITIES Open Source Security is a Different Game It’s time to change your mindset
- 11. DEVELOPERS ARE NOT EFFICIENTLY MANAGING OPEN SOURCE VULNERABILITIES How much time is spent? hours/month None 1 - 10 hours 11 - 20 hours 21 - 35 hours 36 - 60 hours Over 60 hours 15 spent on average by every developer on security vulnerabilities Developers Are Investing Too Much Time On Vulnerabilities Assessment and Remediation 3.8 hours/month spent on security vulnerabilities remediation
- 12. EFFECTIVE VULNERABILITY INEFFECTIVE VULNERABILITY Vulnerability Effectiveness: a novel approach to prioritization Prioritization Is Key To Save Wasted Time On Vulnerabilities Management
- 13. 13 After testing 2,000 Java applications, WhiteSource found that 85% of all detected vulnerabilities were deemed ineffective.
- 15. 15 Bridging the Gap is a Must Security DevOps Developers
- 16. 16 05 Shift Left Is At Its Best With Open Source.
- 17. 17 Turn Developers Into Security Advocates Empower developers with more flexible selection and approval processes Project Planning Requirements Definition Design Development Integration & Test Installation & Acceptance
- 18. 18 Organizations of all sizes are shifting their operational security to software development teams Who owns security in your organization, by company size?
- 19. 19 The impact of developers taking over security is: Integrating security tools earlier in the SDLC of developers are taking action towards application testing on build stage or before. 66% In what stage of the SDLC do you spend most of your time implementing security measures?
- 20. 20 The cost of fixing security and quality issues is rising significantly, as the development cycle advances. Coding $80/Defect Build $240/Defect QA & Security $960/Defect Production $7,600/Defect Detect Issues As Early As Possible
- 21. 21 Detect Issues As Early As Possible - Shift Left The cost of fixing security and quality issues is rising significantly, as the development cycle advances.
- 22. 22 Analyze and prioritize open source security vulnerability remediation Streamline policies with better integration options Shift-left security processes to establish better practices
- 23. Thank You! 23