Increased Reliance on Open Source Means More Risk
Efforts to Secure and Manage Open Source Effectively Are Lagging
July 18, 2017

Tim Mackey
Black Duck Software

The world's appetite for open source software is voracious. In the last year, businesses around the globe significantly increased their use of open source and although they readily acknowledge growing concerns about open source-related security and operational risks, the effective management of open source is not keeping pace with the increase in use.

Those are among the key takeaways from the 2017 Open Source 360° Survey results from Black Duck's Center for Open Source Research and Innovation (COSRI).


Nearly 60 percent of respondents said their organizations' use of open source increased in the last year citing:

■ cost savings, easy access, and no vendor lock-in (84 percent)

■ ability to customize code and fix defects directly (67 percent)

■ better features and technical capabilities (55 percent)

■ the rate of open source evolution and innovation (55 percent)

Additionally, in terms of open source's positive impact on business, survey respondents highlighted accelerated innovation (55 percent) and quality improvement (44 percent).

Even as their organizations are embracing open source to accelerate application development and increase development agility, respondents expressed concern about:

■ license risk/loss of intellectual property (66 percent)

■ exposure to internal applications to exploitation from open source vulnerabilities (64 percent)

■ exposure of external applications to exploitation because of open source vulnerabilities (71 percent)

■ unknown quality of components (74 percent)

■ failure of development teams to adhere to internal policies (61 percent)

Despite those high levels of concern, nearly half of survey respondents indicated their organizations have no formal policies for selecting and approving open source. And just 15 percent indicated they have automated processes in place to manage their open source use.

Respondents gave their organizations decidedly middling marks in areas of managing and securing their open source, with slightly more than half reporting:

■ being in compliance with associated licenses (54 percent)

■ being aware of known security vulnerabilities (55 percent)

■ knowing where and which open source versions are currently integrated and deployed (54 percent)

■ conforming to internal policies (44 percent)

"Companies are using a tremendous amount of open source for sound economic and productivity reasons, but today most companies are not effective in securing and managing it," said Black Duck CEO Lou Shipley. "This is surprising for a number of reasons. Today open source comprises 80 percent to 90 percent of the code in a modern application and the application layer is a primary target for hackers. This means that exploitation from known open source vulnerabilities represents the most significant application security risk most organizations face."

The Open Source 360° survey results show that open source vulnerability tracking and remediation remain primarily manual processes carried out by internal resources (53 percent). Only 27 percent of respondents reported automatic identification and remediation tracking of known open source vulnerabilities.

Other notable findings from the 2017 Open Source 360° survey include:

Methods for tracking use of open source:

■ Information provided by developers (54 percent)

■ Manual design/code reviews (36 percent)

■ Scans to inventory open source in use (33 percent)

Methods for reviewing code for open source use:

■ Don't review code for open source (38 percent)

■ Internal tools to scan for open source (27 percent)

■ Third-party tools to scan for open source (28 percent)

Most important elements to a successful open source policy:

■ A structured process for review and approval of open source use requests (42 percent)

■ A whitelist/blacklist of approved open source components, specific to use cases 39 percent

■ A whitelist/blacklist of approved open source licenses, specific to use cases (39 percent)

Prevalent areas for open source usage:

■ Build applications used within our organization (77 percent)

■ Build applications used by our customers 69 percent

■ Build and run our IT operations infrastructure (69 percent)

Prevalent technology areas for open source use:

■ Development Tools/Software Development Lifecycle (57 percent)

■ Containers/DevOps/Virtualization/Cloud Computing (53 percent)

■ Systems Management/Operating Systems (52 percent)

Open Source Contribution: (66 percent) of companies surveyed contribute to open source projects.

Methodology: The COSRI survey comprised 819 respondents primarily from the US and EMEA, 74 percent of whom were software developers, IT operations/professionals, systems architects, development managers, and security professionals. This year's Open Source 360° Survey conducted by Black Duck's COSRI is the successor to the former Future of Open Source Survey, co-presented for many years by Black Duck and North Bridge.

Tim Mackey is a Technology Evangelist at Black Duck Software
Share this

Industry News

September 27, 2022

DevOps Institute will host SKILup Festival in Singapore on November 15, 2022.

September 27, 2022

Delinea announced the latest release of DevOps Secrets Vault, its high-speed vault for DevOps and DevSecOps teams.

September 27, 2022

The Apptainer community announced version 1.1.0 of the popular container system for secure, high-performance computing (HPC). Improvements in the new version provide a smaller attack surface for production deployments while offering features that improve and simplify the user experience.

September 26, 2022

Secure Code Warrior unveiled Coding Labs, a new mechanism that allows developers to more easily move from learning to applying secure coding knowledge, leading to fewer vulnerabilities in code.

September 26, 2022

ActiveState announced the availability of the ActiveState Artifact Repository.

September 26, 2022

Split Software announced the availability of its Feature Data Platform in the Microsoft Azure Marketplace.

September 22, 2022

Katalon announced the launch of the Katalon Platform, a modern and comprehensive software quality management platform that enables teams of any size to easily and efficiently test, launch, and optimize apps, products, and software.

September 22, 2022

StackHawk announced its Deeper API Security Test Coverage release.

September 21, 2022

Platform9 announced the launch of its latest open source project, Arlon.

September 21, 2022

Redpanda Data announced Redpanda Console.

September 21, 2022

mabl announced its availability as a private listing on Google Cloud Marketplace.

September 21, 2022

Zesty announced a $75 million Series B funding round led by B Capital and Series A investor Sapphire Ventures.

September 20, 2022

Opsera, the Continuous Orchestration platform for DevOps, announced a free trial of its no-code Salesforce Release Management platform for fast and secure Salesforce releases.

September 20, 2022

Sysdig announced ToDo and Remediation Guru.

September 20, 2022

AutoRABIT announced CodeScan Shield.