Source Metadata for AI Agents
Open Source Software (OSS) has had an enormous impact on the development of software within enterprises. Many stages in the software supply chain make use of OSS, and this creates cybersecurity risks that enterprises must address to withstand the ever-increasing threat of being breached by hackers.
This report focuses on OSS security, examining recent high-profile vulnerabilities, how to improve OSS security, and whether vulnerabilities need to be fixed right from the start. Research for this report has been collected from multiple sources linked to and referenced throughout the report. In addition, we have provided proprietary data gathered from our platform and insights from cybersecurity experts within our teams.
Known software vulnerabilities continue to increase year after year, with 25,223 software products affected by at least one vulnerability in 2021. This is an increase from the 24,342 in 2020 and has been driven by the growing scale of software development. The US Bureau of Labor Statistics forecasts that by 2031, demand for developers will grow by 25%.
The upward trend is also affected by enterprises’ increased usage of OSS, and a growing number of “bad actors” that infiltrate the Open Source community. OSS development is fundamentally based on open collaboration, involving the sharing and reuse of source code. The opportunity to inject source code changes that are ultimately consumed by a wide audience entices “bad actors” to exploit the open and collaborative nature of OSS software development. There has been a 700% jump in attacks against open-source projects during the past three years as of September 2022.
As enterprises increase their dependency on OSS to accelerate the rate at which they can deliver value to their stakeholders and customers, they need to balance the benefits with the risks and costs inherent in the consumption of OSS.
Open source is a valuable resource for enterprises. Copyright licences encourage no-charge reuse and redistribution, which saves enterprises large sums of money compared to developing equivalent capabilities in proprietary software. Crowdsourced development also makes it faster for large organisations to build new features and integrations, reducing time-to-market.
In general, the exhaustive peer-review processes relied upon in successful OSS projects have an exceptionally good reputation for strong security. However, the quality and engagement of communities vary wildly. Larger projects, such as major Linux distributions, often have more well-defined procedures and a larger pool of developers to enforce rigorous security practices consistently.
OSS is used across industries; in a 2021 audit of 2,409 codebases, 97% contained open source. Of those, 88% had outdated versions of open-source components where updates or patches had not been applied. BlueOptima data found that 48% of hundreds of thousands of repositories had some level of dependency on outsourced developers.
The OWASP Top 10 outlines the most significant security concerns for web applications.
Top Vulnerability Categories:
IT leaders need to develop a greater awareness of dependencies and proactively monitor components.
BlueOptima’s Code Insights provides objective insights into a development team’s source code. It helps teams accurately identify and eliminate security risks while minimizing the impact on technical debt incurred from shift-left initiatives.