This document discusses open source security risks and provides recommendations. It contains 5 sections: 1. Open source risk is on the rise as open source code accounts for 60-80% of software and reported vulnerabilities are increasing. 2. Developers must change their mindset as open source vulnerabilities differ from proprietary vulnerabilities in detection, publicity and remediation. 3. Prioritizing security vulnerabilities is key as developers spend too much time on ineffective vulnerabilities. 4. Security responsibilities must be delegated between security, DevOps and developers to bridge gaps. 5. Shifting security left by empowering developers and integrating tools earlier can turn developers into advocates and detect issues cheaper.

1. Tackling the Risks of Open
Source Security
5 Things You Need to Know
1
Sharon Sharlin, Product Marketing Manager

2. 2
5 Things To Know About Open Source Security
01
Open Source Risk
Is On The Rise
03
Prioritize Security
Vulnerabilities
02
It’s Time To Change
Your Mindset
04
Delegate Security
Responsibilities
05
Shift Left Is At Its Best
With Open Source

3. 3
01
Open Source Risk
Is On The Rise

4. 4
Are You Spending Enough In AppSec?
The Level of Risk (# of
Breaches Multiplied By
Severeness)
The Level of
Annual Spending
(Investment) in IT Security
Gaps in Security Risks and the Allocation of Spending
Source: Ponemon Institute: The Increasing Risk to Enterprise Applications

5. Open Source Components Account For 60%-80%
Of The Average Software Product
5%-10%
1998
30%-50%
2008
60%-80%
2018
Proprietary Code
Open Source Code
Source: North Bridge Future Of Open Source Survey
Open Source Code
Proprietary Code

6. 96.8%
of developers rely on open
source components
Frequency of Use of Open Source Components

7. The Number of Reported Vulnerabilities is Rising

8. 8
02
It’s Time To Change
Your Mindset

9. Potential vulnerability detected
(SAST & DAST)
No public information
Need to research to find a fix
During development
Detection
Publicity
Remediation
Scan Phase
Known vulnerability
All information is publicly available
Actionable remediation(s) are available
Continuous monitoring (incl. post release)
PROPRIETARY VULNERABILITIES OPEN SOURCE VULNERABILITIES
Open Source Security is a Different Game
It’s time to change your mindset

10. 10
03
Prioritize Security
Vulnerabilities

11. DEVELOPERS ARE NOT EFFICIENTLY MANAGING
OPEN SOURCE VULNERABILITIES
How much time is spent?
hours/month
None
1 - 10 hours
11 - 20 hours
21 - 35 hours
36 - 60 hours
Over 60 hours
15
spent on average by every developer
on security vulnerabilities
Developers Are Investing Too Much Time On
Vulnerabilities Assessment and Remediation
3.8 hours/month
spent on security vulnerabilities
remediation

12. EFFECTIVE
VULNERABILITY
INEFFECTIVE
VULNERABILITY
Vulnerability Effectiveness: a novel approach to prioritization
Prioritization Is Key To Save Wasted Time
On Vulnerabilities Management

13. 13
After testing 2,000 Java
applications, WhiteSource
found that 85% of all
detected vulnerabilities
were deemed ineffective.

14. 14
04
Delegate Security
Responsibilities

15. 15
Bridging the Gap is a Must
Security DevOps Developers

16. 16
05
Shift Left Is At Its Best
With Open Source.

17. 17
Turn Developers Into Security Advocates
Empower developers with more flexible selection and approval processes
Project
Planning
Requirements
Definition
Design
Development
Integration &
Test
Installation &
Acceptance

18. 18
Organizations of all sizes are shifting their operational
security to software development teams
Who owns security in your organization, by company size?

19. 19
The impact of developers taking over security is:
Integrating security tools earlier in the SDLC
of developers are taking action towards
application testing on build stage or
before.
66%
In what stage of the SDLC do you spend most of
your time implementing security measures?

20. 20
The cost of fixing security and quality issues is rising significantly, as the development cycle advances.
Coding
$80/Defect
Build
$240/Defect
QA & Security
$960/Defect
Production
$7,600/Defect
Detect Issues As Early As Possible

21. 21
Detect Issues As Early As Possible - Shift Left
The cost of fixing security and quality issues is rising significantly, as the development cycle advances.

22. 22
Analyze and prioritize
open source security vulnerability remediation
Streamline
policies with better integration options
Shift-left
security processes to establish better practices

23. Thank You!
23