WhiteSource’s Annual Research Report on The State of Open Source Security Vulnerabilities in 2020 found that a record-breaking number of new open source security vulnerabilities was published in 2019. In our research, we focused on open source security’s weakest and strongest points in the hopes of bringing some clarity to the fast-paced and complex space of known open source security vulnerabilities. Join Jeffrey Martin, Senior Director of Product and Sharon Sharlin, Product Marketing Manager at WhiteSource as they discuss: How the open source community is evolving when it comes to security research and what to expect in 2020; Ways software development outfits can implement secure coding from the earliest stages of the DevOps pipeline; Best practices for development, DevOps, and Security teams to make sure they address the most critical issues to their software products’ security.

1. Company Confidential & Proprietary 1
The State of Open Source
Security Vulnerabilities
Presented by:
Jeffrey Martin, Senior Director of Product
Sharon Sharlin, Product Marketing Manager

2. Company Confidential & Proprietary
Key Findings:
1
Reported open source security vulnerabilities rose by 50% from 2018.
Efforts are increasing to improve open source security to ensure the entire
process is as comprehensive and efficient as possible.
2
3
4
There is no languages that is more or less secure. It depends on
many different factors.
Over 50% of the open source security vulnerabilities published over
the past year are either high or critical severity scores.
In 2020, we’ll see the open source community and the software development industry
continuing to invest efforts in addressing the increasing rise in open source
vulnerabilities.
In 2020, we’ll see the open source community and the software
development industry investing efforts in addressing the increasing rise in
open source vulnerabilities.5
The most common CWEs are a result of simple coding errors,
across most top programming languages.

3. Company Confidential & Proprietary 3
Open Source Security
Vulnerabilities Are On The Rise
1

4. Company Confidential & Proprietary
Open Source Security Vulnerabilities Are On The Rise
50%

5. Company Confidential & Proprietary 5
Over 85%of open
source security
vulnerabilities are
disclosed with a fix
already available.

6. Company Confidential & Proprietary 6
Only 84%of
known open source
vulnerabilities
eventually appear in
the NVD.

7. Company Confidential & Proprietary 7
45%of reported open
source vulnerabilities are
not initially reported to the
NVD.
Only 29%of all open
source vulnerabilities reported
outside of the NVD are
eventually published in it.

8. Company Confidential & Proprietary 8
Tech Giants have invested heavily in
better securing and managing open
source projects over the past few years,
and the community is working hard at
security research to publish newly
discovered open source security
vulnerabilities along with a fix.

9. Company Confidential & Proprietary 9
2Which Programming
Languages Are Most Secure?

10. Company Confidential & Proprietary 10
Open Source Vulnerabilities Per Language

11. Company Confidential & Proprietary
11
3Which CWE’s Do We
Need to Watch Out
for in 2020?

12. Company Confidential & Proprietary 12
Most Common CWE’s in 2019

13. Company Confidential & Proprietary
CWE-352 — Cross-Site
Request Forgery (CSRF)
emerged in the top 10 CWEs this year
13
CWE-89 — SQL Injection
re-emerged after it wasn’t one of the top CWE’s
since 2015.
Interesting Comebacks

14. Company Confidential & Proprietary 14
Most Common CWE’s Per Language in 2019

15. Company Confidential & Proprietary 15
Vulnerability Severity Scoring:
An Objective Prioritization
Standard?
4

16. Company Confidential & Proprietary
The rising number of reported vulnerabilities
requires that development teams quickly prioritize
their security alerts
16

17. Company Confidential & Proprietary 17
Vulnerability Severity Scoring:
An Objective Prioritization Standard?

18. Company Confidential & Proprietary 18
How Can You Prioritize Vulnerabilities When Over 55% Are
High-severity Or Critical?

19. Company Confidential & Proprietary 19
5Our Predictions for 2020

20. Company Confidential & Proprietary 20
New initiatives are being looked for in
order to address the chaos in open
source security processes
What Can We Expect?

21. Company Confidential & Proprietary
21
What Can We Expect?
Reported Open Source Vulnerabilities
Are Likely to Rise..
And That’s a Good Thing

22. Company Confidential & Proprietary
Q&A
22

23. Company Confidential & Proprietary
Thank You!
23