Companies Overlook Risks in Open Source Software, Survey Finds (betanews.com)

An anonymous reader shares a report: Open source code helps software suppliers to be nimble and build products faster, but a new report reveals hidden software supply chain risks of open source that all software suppliers and IoT manufacturers should know about. The recent Equifax breach for example exploited a vulnerability in a widely used open source web framework, Apache Struts, and the study by software monetization specialist Flexera points out that as much as 50 percent of code in commercial and IoT software products is open source. "We can't lose sight that open source is indeed a clear win. Ready-to-go code gets products out the door faster, which is important given the lightning pace of the software space," says Jeff Luszcz, vice president of product management at Flexera. "However, most software engineers don't track open source use, and most software executives don't realize there's a gap and a security/compliance risk." Flexera surveyed 400 software suppliers, Internet of Things manufacturers and in-house development teams. It finds only 37 percent of respondents to the survey have an open source acquisition or usage policy, while 63 percent say either their companies either don't have a policy, or they don't know if one exists. Worryingly, of the 63 percent who say their companies don't have an open source acquisition or usage policy, 43 percent say they contribute to open source projects. There is an issue over who takes charge of open source software too. No one within their company is responsible for open source compliance, or they don't know who is, according to 39 percent of respondents.

Comments

How is it different for closed source software?

[fred6666]

How is it any different for closed source software? What if that proprietary software haven't been updated in years? Surely if there is no update, there is no security risk, right?

Re:How is it different for closed source software?

[DickBreath]

If Equifax had used a proprietary server, not updated it in years, even though there was a published vulnerability, and then blamed the vendor, I bet that middle manager would be surprised at what would happen if they simply try to "blame the vendor".

The Apache Foundation pointed out that Equifax was using unpatched software with a known vulnerability. How much louder would a commercial software company say that in public?

Dear Middle Manager: Using proprietary software in order to "blame the vendor" may actually hurt your career worse than using open source software. The real thing that hurts your career is being incompetent and not doing basic things like patching software. Especially when you know that you are handling highly confidential private data that is a high value target to steal.