The document discusses open source software, noting that it is used almost everywhere due to its low cost and customizability. While open source provides benefits, it also poses security risks if vulnerabilities are not addressed. Many major security breaches have exploited vulnerabilities in open source components. The document recommends maintaining awareness of open source vulnerabilities, updating and patching software often, leveraging security professionals, and participating in open source communities to help improve security.

1. Open Source Security
Michael W. Hawkins
CEO, Netizen Corporation
https://www.NetizenCorp.com
MHawkins@NetizenCorp.com

2. © 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
Open Source: Security Risks and Benefits
open source
initiative

3. © 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
What Is It?
Open Source (adj) –
denoting software for which the original source code is made freely
available and may be redistributed and modified
Open Source is “free” as in speech, not
necessarily “free” as in beer

4. © 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
In Open Source, you have
the right to control your own
destiny.
Linus Torvalds
Creator of the Linux operating system
Open Source = Transparency and Freedom
“
”

5. © 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
Where is Open Source used?
(hint: everywhere)

6. According to a 2017 Black Duck Software report, open
source components are now present in 96 percent of
commercial applications. The average commercial
application has 147 different open source components.
Source: https://www.blackducksoftware.com/open-source-security-risk-analysis-2017 © 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
Where is Open Source used?

7. © 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
What Are The Benefits?
Typically low
or no cost (as
in price) to
own and use
Can be
customized
and/or
redistributed
No hidden
code – what
you see is
what you get
Can be easily
packaged into
commercial
products
Can release
features and
patches
quickly

8. • Can have a high cost to maintain - it can require expertise
• You are on your own to determine security worthiness/fitness
• Security, maintenance and configuration is entirely up to you
• Typically there are no guarantees at all of security and/or quality
“…only 28 percent of organizations do any kind of regular analysis to find
out what components are built into their applications.”
© 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
What Are The Drawbacks?
Source: https://www.veracode.com/resources/state-of-software-security

9. 2017 Equifax Breach
• Failed to patch a known security issue in an open source web application server (Struts)
HeartBleed (openssl)
• Affected HUNDREDS OF MILLIONS of products, companies, applications and websites
• Caused a major breach at a large healthcare provider and many others
Quadrooter (Android), Glibc (programming languages), and on and on…
Over 900 major Open Source vulnerabilities were reported in 2017 alone
and it takes an average of 2.9 years to find and report these issues.
© 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
Open Source Security Gone Wrong
Source: https://snyk.io/stateofossecurity/

10. MAINTAIN AWARENESS
© 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
What Can You Do?

11. UPDATE AND PATCH OFTEN
© 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
What Can You Do?

12. READ THE DOCUMENTATION
© 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
What Can You Do?

13. LEVERAGE PROFESSIONALS
© 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
What Can You Do?

14. PERFORM TESTING
© 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
What Can You Do?

15. MAINTAIN AN INVENTORY
© 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
What Can You Do?

16. PERFORM ASSESSMENTS
© 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
What Can You Do?

17. PARTICIPATE AND CONTRIBUTE
© 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
What Can You Do?

18. © 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
Bonus Information
Some good Open Source security tools:
ELK Stack
OWASP Zap
Sonarqube

19. © 2018 Netizen Corporation | www.Netizen.net | 800-450-1773
Questions?