By Paul Davis, CISO, JFrog
IT outages and cyberattacks have been consistently headlining the biggest discussions around ransomware, software supply chains and open source software security, especially with recent incidents like the worldwide CrowdStrike outage, malicious Hugging Face ML models and Change Healthcare data breach. These events have put a spotlight on the true difficulty of protecting our digital infrastructures.
This is not an easy task as indicated by a recent survey that found that 60% of DevOps professionals work 4 or more days remediating application vulnerabilities in a given month – or a quarter of total working time on remediation alone. These issues lead to downstream security frustrations. The growing adoption of open-source code brings undeniable advantages for time-strapped developers dealing with the need to deliver software updates and remediate vulnerabilities, while being asked to fostering collaborative development and accelerate progress. The world needs our developers to be enabled with the right tools to help them identify and prevent bad code (and only using safe libraries) as they create innovative solutions to our business problems. This will lead to them spending less time remediating errors in code that has been released into production. A key aspect of achieving this goal is to address the challenge of safely using open source libraries.
Open Source Libraries: A Double-Edged Sword
A June 2024 report from the Cybersecurity and Infrastructure Security Agency (CISA) found that 52% of open-source projects are written in memory-unsafe languages like C and C++. This same report, unfortunately, found that 94% of the projects they reviewed are also leveraging open source dependencies that are written using memory unsafe code. The report attributes the prevalence of this unsafe code to the continual need for developers to work under tight time constraints, sometimes having to sacrifice code quality with the need to release on time, relying blindly that the open source code libraries that they use are secure. Ultimately, the challenge of keeping critical open source projects safe and production systems robust grows in difficulty as organizations continue to innovate and develop new capabilities. Companies must temper with balance between meeting demand and maintaining security. This report underscores the critical need for DevSecOps to be vigilant as manage their security tools, awareness and risk appetite for open source security success.
In today’s software-driven world, the mantra “release fast or die” propels development, creating intense demand for speed of software development and deployment. Developers juggle business requirements while security teams add layers of protection. If handled incorrectly, this conflict can prolong timelines. Tempting as it may be to cut corners, IDC’s wisdom prevails: “What’s safe today may not be safe tomorrow.” Post-deployment fixes for binary vulnerabilities, as IDC notes, can cost millions. It’s wiser to confront, assess and solve security issues before deploying software, avoiding repercussions in the high-stakes runtime arena. In an era of ceaseless innovation, security isn’t an option; it’s the pivot between triumph and disaster.
Key Considerations for Developers
In the intricate world of software development, the collaboration between developers, operations, and security teams is the linchpin for cultivating and deploying secure software faster.
There are three key areas for developers to consider:
- Have a consistent standardized approach to management and updating of vulnerable dependencies. This will help thwart emerging security threats.
- Conduct thorough source code and binary reviews, using automation to help. This will help guarantee the authenticity and integrity of your in-house source code and third-party components, thereby mitigating potential business impacting risks.
- Implementing a continuous monitoring and automated vulnerability alerting for open source libraries, in addition to vulnerability scanning. The proactive identification and remediation of security weaknesses will bolster the reliability and resilience of your software, bolster user confidence, and safeguard digital ecosystems at large.
Integrating security tools seamlessly into a developer’s environment and development workflows offers a transformative advantage. Moving away from managing numerous disparate tools, a consolidated end to end platform approach streamlines the software development lifecycle, fostering efficiency and collaboration. This approach not only expedites problem-solving but also fortifies security by quickly identifying and minimizing vulnerabilities. In the face of evolving threats, the consolidated platform approach emerges as a strategic necessity, empowering organizations to tackle challenges while enhancing their overall security posture.
Conclusion: Securing the Software Supply Chain: A Fortified Approach
As developers traverse the dynamic landscape of open-source software, a cardinal principle stands tall – security must permeate every facet of the software supply chain. Injecting security measures at every juncture of the SDLC is akin to fortifying the ramparts of a digital fortress, safeguarding against intrusions and vulnerabilities, both on the perimeter and inside. A robust tool that scans and blocks OSS components from infiltrating the software supply chain from the outset holds the key to a more secure future. The onus is on leadership and developers to prioritize security in their projects. By leveraging the arsenal of linked security tools at their disposal, they can create a resilient ecosystem where innovation and safety harmoniously coexist. The journey towards secure open-source code is not just a responsibility; it is a testament to the unwavering commitment to a digital landscape that thrives on collaboration, innovation, and security.
##
ABOUT THE AUTHOR
Paul is an experienced IT Security Executive who, as Field CISO at JFrog, works to help CISOs, IT execs and security teams, enhance protection of their software supply chain. Additionally, he advises IT security startups, mentors security leaders, and provides guidance on various IT security trends. Paul also spends his time exploring the latest technologies, DJing, reading, and boating.
