Kubiya.ai announces the launch of its DevOps Digital Agents.
The world's appetite for open source software is voracious. In the last year, businesses around the globe significantly increased their use of open source and although they readily acknowledge growing concerns about open source-related security and operational risks, the effective management of open source is not keeping pace with the increase in use.
Those are among the key takeaways from the 2017 Open Source 360° Survey results from Black Duck's Center for Open Source Research and Innovation (COSRI).
Nearly 60 percent of respondents said their organizations' use of open source increased in the last year citing:
■ cost savings, easy access, and no vendor lock-in (84 percent)
■ ability to customize code and fix defects directly (67 percent)
■ better features and technical capabilities (55 percent)
■ the rate of open source evolution and innovation (55 percent)
Additionally, in terms of open source's positive impact on business, survey respondents highlighted accelerated innovation (55 percent) and quality improvement (44 percent).
Even as their organizations are embracing open source to accelerate application development and increase development agility, respondents expressed concern about:
■ license risk/loss of intellectual property (66 percent)
■ exposure to internal applications to exploitation from open source vulnerabilities (64 percent)
■ exposure of external applications to exploitation because of open source vulnerabilities (71 percent)
■ unknown quality of components (74 percent)
■ failure of development teams to adhere to internal policies (61 percent)
Despite those high levels of concern, nearly half of survey respondents indicated their organizations have no formal policies for selecting and approving open source. And just 15 percent indicated they have automated processes in place to manage their open source use.
Respondents gave their organizations decidedly middling marks in areas of managing and securing their open source, with slightly more than half reporting:
■ being in compliance with associated licenses (54 percent)
■ being aware of known security vulnerabilities (55 percent)
■ knowing where and which open source versions are currently integrated and deployed (54 percent)
■ conforming to internal policies (44 percent)
"Companies are using a tremendous amount of open source for sound economic and productivity reasons, but today most companies are not effective in securing and managing it," said Black Duck CEO Lou Shipley. "This is surprising for a number of reasons. Today open source comprises 80 percent to 90 percent of the code in a modern application and the application layer is a primary target for hackers. This means that exploitation from known open source vulnerabilities represents the most significant application security risk most organizations face."
The Open Source 360° survey results show that open source vulnerability tracking and remediation remain primarily manual processes carried out by internal resources (53 percent). Only 27 percent of respondents reported automatic identification and remediation tracking of known open source vulnerabilities.
Other notable findings from the 2017 Open Source 360° survey include:
Methods for tracking use of open source:
■ Information provided by developers (54 percent)
■ Manual design/code reviews (36 percent)
■ Scans to inventory open source in use (33 percent)
Methods for reviewing code for open source use:
■ Don't review code for open source (38 percent)
■ Internal tools to scan for open source (27 percent)
■ Third-party tools to scan for open source (28 percent)
Most important elements to a successful open source policy:
■ A structured process for review and approval of open source use requests (42 percent)
■ A whitelist/blacklist of approved open source components, specific to use cases 39 percent
■ A whitelist/blacklist of approved open source licenses, specific to use cases (39 percent)
Prevalent areas for open source usage:
■ Build applications used within our organization (77 percent)
■ Build applications used by our customers 69 percent
■ Build and run our IT operations infrastructure (69 percent)
Prevalent technology areas for open source use:
■ Development Tools/Software Development Lifecycle (57 percent)
■ Containers/DevOps/Virtualization/Cloud Computing (53 percent)
■ Systems Management/Operating Systems (52 percent)
Open Source Contribution: (66 percent) of companies surveyed contribute to open source projects.
Methodology: The COSRI survey comprised 819 respondents primarily from the US and EMEA, 74 percent of whom were software developers, IT operations/professionals, systems architects, development managers, and security professionals. This year's Open Source 360° Survey conducted by Black Duck's COSRI is the successor to the former Future of Open Source Survey, co-presented for many years by Black Duck and North Bridge.
Industry News
Aviatrix® introduced Aviatrix Distributed Cloud Firewall for Kubernetes, a distributed cloud networking and network security solution for containerized enterprise applications and workloads.
Stride announces the general availability of Stride Conductor, its new autonomous coding product that transforms the software development landscape.
CircleCI unveiled CircleCI releases, which enables developers to automate the release orchestration process directly from the CircleCI UI.
Fermyon™ Technologies announces Fermyon Platform for Kubernetes, a WebAssembly platform for Kubernetes.
Akuity announced a new offer targeted at Enterprises and businesses where security and compliance are key.
New Relic launched new capabilities for New Relic IAST (Interactive Application Security Testing), including proof-of-exploit reporting for application security testing.
OutSystems announced AI Agent Builder, a new solution in the OutSystems Developer Cloud platform that makes it easy for IT leaders to incorporate generative AI (GenAI) powered applications into their digital transformation strategy, as well as govern the use of AI to ensure standardization and security.
Mirantis announced significant updates to Lens Desktop that makes working with Kubernetes easier by simplifying operations, improving efficiency, and increasing productivity. Lens 2024 Early Access is now available to Lens users.
Codezero announced a $3.5 million seed-funding round led by Ballistic Ventures, the venture capital firm dedicated exclusively to funding entrepreneurs and innovations in cybersecurity.
Prismatic launched a code-native integration building experience.
Check Point® Software Technologies Ltd. announced its Check Point Infinity Platform has been ranked as the #1 Zero Trust Platform in the latest Miercom Zero Trust Platform Assessment.
Tricentis announced the launch and availability of SAP Test Automation by Tricentis as an SAP Solution Extension.
Netlify announced the general availability of the AI-enabled deploy assist.
DataStax announced a new integration with Airbyte that simplifies the process of building production-ready GenAI applications with structured and unstructured data.