Increased Reliance on Open Source Means More Risk
Efforts to Secure and Manage Open Source Effectively Are Lagging
July 18, 2017

Tim Mackey
Black Duck Software

The world's appetite for open source software is voracious. In the last year, businesses around the globe significantly increased their use of open source and although they readily acknowledge growing concerns about open source-related security and operational risks, the effective management of open source is not keeping pace with the increase in use.

Those are among the key takeaways from the 2017 Open Source 360° Survey results from Black Duck's Center for Open Source Research and Innovation (COSRI).


Nearly 60 percent of respondents said their organizations' use of open source increased in the last year citing:

■ cost savings, easy access, and no vendor lock-in (84 percent)

■ ability to customize code and fix defects directly (67 percent)

■ better features and technical capabilities (55 percent)

■ the rate of open source evolution and innovation (55 percent)

Additionally, in terms of open source's positive impact on business, survey respondents highlighted accelerated innovation (55 percent) and quality improvement (44 percent).

Even as their organizations are embracing open source to accelerate application development and increase development agility, respondents expressed concern about:

■ license risk/loss of intellectual property (66 percent)

■ exposure to internal applications to exploitation from open source vulnerabilities (64 percent)

■ exposure of external applications to exploitation because of open source vulnerabilities (71 percent)

■ unknown quality of components (74 percent)

■ failure of development teams to adhere to internal policies (61 percent)

Despite those high levels of concern, nearly half of survey respondents indicated their organizations have no formal policies for selecting and approving open source. And just 15 percent indicated they have automated processes in place to manage their open source use.

Respondents gave their organizations decidedly middling marks in areas of managing and securing their open source, with slightly more than half reporting:

■ being in compliance with associated licenses (54 percent)

■ being aware of known security vulnerabilities (55 percent)

■ knowing where and which open source versions are currently integrated and deployed (54 percent)

■ conforming to internal policies (44 percent)

"Companies are using a tremendous amount of open source for sound economic and productivity reasons, but today most companies are not effective in securing and managing it," said Black Duck CEO Lou Shipley. "This is surprising for a number of reasons. Today open source comprises 80 percent to 90 percent of the code in a modern application and the application layer is a primary target for hackers. This means that exploitation from known open source vulnerabilities represents the most significant application security risk most organizations face."

The Open Source 360° survey results show that open source vulnerability tracking and remediation remain primarily manual processes carried out by internal resources (53 percent). Only 27 percent of respondents reported automatic identification and remediation tracking of known open source vulnerabilities.

Other notable findings from the 2017 Open Source 360° survey include:

Methods for tracking use of open source:

■ Information provided by developers (54 percent)

■ Manual design/code reviews (36 percent)

■ Scans to inventory open source in use (33 percent)

Methods for reviewing code for open source use:

■ Don't review code for open source (38 percent)

■ Internal tools to scan for open source (27 percent)

■ Third-party tools to scan for open source (28 percent)

Most important elements to a successful open source policy:

■ A structured process for review and approval of open source use requests (42 percent)

■ A whitelist/blacklist of approved open source components, specific to use cases 39 percent

■ A whitelist/blacklist of approved open source licenses, specific to use cases (39 percent)

Prevalent areas for open source usage:

■ Build applications used within our organization (77 percent)

■ Build applications used by our customers 69 percent

■ Build and run our IT operations infrastructure (69 percent)

Prevalent technology areas for open source use:

■ Development Tools/Software Development Lifecycle (57 percent)

■ Containers/DevOps/Virtualization/Cloud Computing (53 percent)

■ Systems Management/Operating Systems (52 percent)

Open Source Contribution: (66 percent) of companies surveyed contribute to open source projects.

Methodology: The COSRI survey comprised 819 respondents primarily from the US and EMEA, 74 percent of whom were software developers, IT operations/professionals, systems architects, development managers, and security professionals. This year's Open Source 360° Survey conducted by Black Duck's COSRI is the successor to the former Future of Open Source Survey, co-presented for many years by Black Duck and North Bridge.

Tim Mackey is a Technology Evangelist at Black Duck Software
Share this

Industry News

May 25, 2022

JFrog introduced Project Pyrsia, an open-source software community initiative that utilizes blockchain technology to secure software packages (A.K.A Binaries) from vulnerabilities and malicious code.

May 25, 2022

Kasm Technologies, in partnership with Docker, has developed Kasm Workspaces as a Containerized Desktop Infrastructure platform for streaming remote workspaces directly to your web browser.

May 25, 2022

Cascadeo announced the integration of Amazon DevOps Guru with cascadeo.io, Cascadeo’s cloud monitoring and management platform that provides users with a single view of multi-cloud or hybrid infrastructure environments.

May 24, 2022

Oracle announced the availability of Java 18, the latest version of the programming language and development platform.

May 24, 2022

Docker announced the acquisition of Tilt, makers of a development environment as code for teams on Kubernetes.

May 24, 2022

F5 announced the release of F5 NGINX for Microsoft Azure, an Azure-native service offering developed in partnership with Microsoft, that helps customers deliver modern applications on Azure with just a few clicks.

May 24, 2022

Pegasystems announced a strategic partnership with Google Cloud that will help enable joint clients to accelerate their digital transformations with Pega’s low-code enterprise software on Google Cloud’s highly scalable cloud services.

May 23, 2022

Sauce Labs announced the release of contract testing with mocking on the Sauce Labs API Testing Platform.

May 23, 2022

Pure Storage announced a series of updates to its Portworx portfolio.

May 23, 2022

StackHawk has secured $20.7 million in capital.

May 19, 2022

Jellyfish announced the launch of Jellyfish Benchmarks, a way to add context around engineering metrics and performance by introducing a method for comparison.

May 19, 2022

Solo.io announced the addition and integration of Cilium networking into its Gloo Mesh platform, providing a complete application-networking solution for companies’ cloud-native digital transformation efforts.

May 19, 2022

Aqua Security announced multiple updates to Aqua Trivy, making it a unified scanner for cloud native security.

May 18, 2022

Red Hat unveiled updates across its portfolio of developer tools designed to help organizations build and deliver applications faster and more consistently across Kubernetes-based hybrid and multicloud environments.

May 18, 2022

Armory announced public early access to their new Continuous Deployment-as-a-Service product.