During a recent webinar, Phil Odence, General Manager of the Synopsys Black Duck Audit Group presented "Open Source Risk in M&A by the Numbers" For more information, please visit www.synopsys.com/BlackDuck

1. © 2019 Synopsys, Inc.1
Phil Odence, General Manager, Synopsys Black Duck Audit Group
phil.odence@synopsys.com
May 2, 2019
Open Source Risks Persist—But Management Is Improving
Open Source Risk in M&A by the Numbers

2. © 2019 Synopsys, Inc.2
Agenda
Background
Software, open source, OSSRA report
Results
Usage, license risks, security risks
Conclusions
Trends, takeaways, and tips for managing in M&A
Phil Odence, General Manager
Black Duck Audit Group
phil.odence@synopsys.com

3. © 2019 Synopsys, Inc.3
Background
Software, open source, OSSRA report

4. © 2019 Synopsys, Inc.4
Modern software
=
Proprietary code
+
Open source components
+
Commercial components
+
API usage
…inherent risks

5. © 2019 Synopsys, Inc.5
The fundamental issue…
Codebase
Commercial
third-party code
Purchasing
• Licensing?
• Security?
• Quality?
• Support?
Open source
OPERATIONAL FACTORS
Which versions of code are being used,
and how old are they (dead projects)?
LEGAL RISK
Which licenses are used, and do they
match anticipated use of the code?
SECURITY RISK
Which components have
vulnerabilities, and what are they?
Management
visibility—not!
“Many open-source assets are
either undermanaged or altogether
unmanaged.” —Gartner, 2017

6. © 2019 Synopsys, Inc.6
Why acquirers worry
• Concerns have gone from unusual to being the norm
in tech M&A due diligence
• “Many open-source assets are either undermanaged
or altogether unmanaged once established within an IT
portfolio.” —Gartner
• And even more so for smaller companies
• Deeper pockets may draw fire

7. © 2019 Synopsys, Inc.7
Open Source Security and Risk Assessment
• Fourth year
• 1,200+ Black Duck Audits on codebases
• Software of
– Tech companies
– Mostly M&A related
• Data anonymized and aggregated

8. © 2019 Synopsys, Inc.8
Black Duck Audits: 1,200+ codebases across all industries
Industry Distribution
Enterprise Software/SaaS 23%
Healthcare, Health Tech, Life Sciences 11%
Financial Services & FinTech 10%
Big Data, AI, BI, Machine Learning 9%
Retail & E-Commerce 7%
Aerospace, Aviation, Automotive, Transportation, Logistics 6%
Internet & Software Infrastructure 5%
Internet of Things 5%
Telecommunications & Wireless 4%
Cybersecurity 3%
Virtual Reality, Gaming, Entertainment, Media 3%
Manufacturing, Industrials, Robotics 3%
Internet and Mobile Apps 3%
Marketing Tech 2%
EdTech 2%
Computer Hardware & Semiconductors 2%
Energy & CleanTech 1%

9. © 2019 Synopsys, Inc.9
Results
Usage, license risks, security risks

10. © 2019 Synopsys, Inc.10
Tech companies use open source…lots!
of the 2018 audited
code analyzed was
open source
of audited codebases
contained open source
of audited codebases
contained more than
50% open source

11. © 2019 Synopsys, Inc.11
And more than they know…
• Few targets were able to
produce a list with any
confidence
• When they could, it tended to
be about 50% accurate
Average codebase audited by
Black Duck contained 298 open
source components
(up from 257 last year)

12. © 2019 Synopsys, Inc.12
All industries use a substantial percentage of open source
Table 2: Average percentage of
open source in each audited codebase by industry

13. © 2019 Synopsys, Inc.13
The top 10 components are quite common

14. © 2019 Synopsys, Inc.14
Legal risk in software
• Risk: Using code without complying with licenses
can lead to lawsuits, loss of IP, distraction, reputational
issues, remediation
• License / terms-of-use issues
– With respect to open source and third-party code
– Requires analyzing software composition: what’s in the code
• Copyright law applies to software: Essentially,
you need a license
• Fundamental challenge: Most companies don’t know
what’s in their code

15. © 2019 Synopsys, Inc.15
License issues remain significant in codebases
contained custom
licenses that had the
potential to cause
conflict or needed
legal review
contained
components with
license conflicts
contained
components that
were “not licensed”
contained some
form of GPL
conflict
of the audited
codebases contained
license issues

16. © 2019 Synopsys, Inc.16
Open source license compliance remains critical
Percentage of codebases with license conflicts

17. © 2019 Synopsys, Inc.17
Options for remediating license issues
Remove A minor feature may not be worth the risk.
Replace
Perhaps with a similar open source or commercial component. For
common capabilities, there may be similar components under compatible
licenses.
Rewrite Recreate the functionality with proprietary code.
Relicense
Some copyright holders are willing to license software under different
terms, perhaps another open source license or some commercial
arrangement.
Respect
As usage matters, there are cases, particularly with medium-risk licenses,
that the way the component is used may be easily modified and allow you
to respect the terms of the license.

18. © 2019 Synopsys, Inc.18
Security is a growing focus in M&A
“Companies are intensifying due diligence
of acquisition targets to avoid costly
cybersecurity surprises, particularly when
intellectual property, such as software code
or customer data drive the deal.”—WSJ
“’Security problems,’ said ADP’s chief security
officer Roland Cloutier, ‘could kill any deal.’”

19. © 2019 Synopsys, Inc.19
Equifax breach focused attention on open source security
Over 5,000 new vulnerabilities
are discovered in open source
components each year.

20. © 2019 Synopsys, Inc.20
Open source vulnerabilities are commonplace, and
organizations are failing to protect against them
contained
vulnerabilities over
10 years old
of the audited
codebases
contained
vulnerabilities
contained high-risk
vulnerabilities
contained
components that
were more than four
years out-of-date or
had no development
activity in the last
two years

21. © 2019 Synopsys, Inc.21
CVE-2000-0388
Reporting date
May 9, 1990
Impact
A buffer overflow when processing the TERMCAP environment variable in FreeBSD 3.4 and
prior could result in a local exploit resulting in privilege escalation
Mitigation
Update the FreeBSD operating environment to a modern version
A vulnerability older than many developers and found within the 2018 OSSRA dataset

22. © 2019 Synopsys, Inc.22
Conclusions
Trends, takeaways, and tips for managing in M&A

23. © 2018 Synopsys, Inc.23
Trends
• Usage continue up
– 60% open source, up from 57%
– Components per codebase 298, up from 257
• License compliance still an issue, but showing improvement
– Codebases with conflicts 68% vs. 74% for 2017
• Security similarly has improved, though still a concern
– 60% of codebases contained unpatched vulnerabilities,
compared to 78% last year
All good!
?

24. © 2019 Synopsys, Inc.24
Key takeaways
• For good reasons, open source makes up a significant amount
of software in all industries
• Most companies don’t manage very well, so…
• Open source license and security issues pervade most codebases
• In M&A, acquirers and sellers need to recognize and manage

25. © 2019 Synopsys, Inc.25
Buyers: Manage the risk in M&A
Due diligence
• Disclosures
– Policies
– Processes
• Discussions
• Do Black Duck Audits
Dealing
• Remediation
• Reps / warranties
• Modified terms
• Adjusted valuation

26. © 2019 Synopsys, Inc.26
Sellers: Manage before the event
One year out
• Be prepared to provided open source bill of materials
• Work with IP attorney
• Implement open source strategy, policy, process, and tools
• May be simple depending on organization
Weeks/months out
• Organize a prediligence audit
• Remediate any issues and rescan
• Provide report as a sales tool

27. Thank You
phil.odence@synopsys.com