To keep pace with the increasing demands of software development and delivery, the need for developers to leverage open source components and third party libraries continues to grow. Coupled with the escalating number of vulnerabilities these practices introduce, the result is an increased number of vulnerable entry points for cyber-criminals to exploit. However, this does not mean that companies should or must stop using components in their development efforts. Any company that forbids the use of components would be putting itself at a severe disadvantage in the digital economy. Developers though do need to consider the security aspects of using open source libraries and components as part of their build and testing process.

1. © 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.© 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.!1
Building Blocks of Secure
Development: How to Make Open
Source Work for You
Mark Curphey

2. © 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.!2
• Developers didn’t think about security
during the software development process
• The result was “patch and pray”
• Vendors were reactive and subsequently
customers had to be reactive
In The Past….

3. © 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.!3
The Old Way….
• Vendors hired experts to test software right
before release
• A mixture of manual and automated tools were
used to generate a list of security issues
• Vendor decided how much they could fix and
what delay they could tolerate

4. © 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.!4
The Result….
Delays and Accidents

5. © 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.!5
Not Sustainable
• Attackers are everywhere and
their attacks are more and
more automated
• Customers expect more
• Losing customer trust means
losing money

6. © 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.!6
Principles of Secure by Design
• Continuous – security is built-in throughout the
entire software lifecycle
• Measurability – ensure the activities performed
are producing the desired result and can be
optimized
• Transparency – ability to describe your secure
development process and the security
mechanisms you used to regulators and customers

9. NumberofLibraries
0
2012 2014
Year
2016 2018 2020 2022 2024 2026
100
Million
200
Million
300
Million
400
Million
500
Million

10. Custom Code
Open-Source
Are you introducing vulnerabilities
in the code you are writing ?
Before DeOps

11. Custom Code (~10%)
Open-source code (~ 20%)
Open-source code (~ 70%)

12. Open-Source Code
Custom Code
What open source are you using?
After DeOps
Where did it come from?
What does it do ?
What vulnerabilities are present ?
The Attack Surface Has Changed

13. From YOU to:
• Developer Tools
Open-Source Code
3rd Party Developers
Control Over What is in Your Code Has Changed

14. Reintroduced
Half-Days
Similar Embedded
Inherited Disclosed
Malware
Adware Insecure Coding

15. Code Build Scan Ship
You MUST scan
after build.
Grepping sure
code will not work.

16. 1. What open source are you using ?
2. Where did it come from ?
3. What does it do ?
4. What vulnerabilities are present ?
Open source is amazing ! We should all open-source
Must know the answer to four basic questions:

17. © 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.© 2017 VERACODE INC. A BUSINESS UNIT OF CA TECHNOLOGIES.!17
Thank You