|By Derek Weeks||
|October 31, 2016 04:00 AM EDT||
Analysis of 25,000 applications reveals 6.8% of packages/components used included known defects. Organizations standardizing on components between 2 - 3 years of age can decrease defect rates substantially.
Open source and third-party packages/components live at the heart of high velocity software development organizations. Today, an average of 106 packages / components comprise 80 - 90% of a modern application, yet few organizations have visibility into what components are used where.
Use of known defective components leads to quality and security issues within applications. While developers save tremendous amounts of time by sourcing software components from outside their organizations, they often don't have time to check those component versions against known vulnerability databases or internal policies.
In Sonatype's 2016 State of the Software Supply Chain report, analysis of 25,000 scans reveals that 1 in 16 (6.8%) components being used in applications contained at least one known security vulnerability. This finding demonstrates that defective components are making their way across the entire software supply chain -- from initial sourcing to use in finished goods.
Newer components make better software
Analysis of the scanned applications also revealed that the latest versions of components had the lowest percentage of known defects. Components under three years in age represented 38% of parts used in the average application; these components had security defect rates under 5%.
By comparison, components between five and seven years old had 2x the known security defect rate. The 2016 Verizon Data Breach and Investigations Report confirms that the vast majority of successful exploits last year were from CVE's (Common Vulnerabilities and Exposures) published 1998 - 2013. Combining the Verizon data with Sonatype's analysis further demonstrates the economic value of using newer, higher quality components.
In summary, components greater than two years old represent 62% of all components scanned and account for 77% of the risk. Better component selection not only improves the quality of the finished application, it also reduces the number of break-fixes and unplanned work to remediate the defects.
Older components die off
Research shows that new versions of open source components are released an average of 14x per year. The new versions deliver greater functionality, improved performance, and fewer known defects. Just as in traditional manufacturing, using the newest versions of any part typically results in a higher quality finished product.
In their 2016 report, Sonatype discovered that component versions seven years or older made up approximately 18% of the footprint of the 25,000 application scans. For the older components, analysis showed that as many as 23% were on the latest version -- meaning, the open source projects for those components were inactive, dead...or perhaps they are just incredibly stable.
Discovery of components with known security vulnerabilities or other defects used in applications is not something anyone desires. Unfortunately, when these defects are discovered in older components, chances of remediating the issue by upgrading to a newer component version are greatly diminished. If a new version does not exist, only a few options exist:
Keep the vulnerable component in the application
Wwitch to a newer like component from another open source project
Make a software change to add a mitigating control, or
Code the functionality required from scratch in order to replace the defect.
None of these options comes without a significant cost.
As discussed in Cisco's 2015 Midyear Security Report, "With open-source software in place in many enterprises, security professionals need to gain a deeper understanding of where and how open-source is used in their organizations, and whether their open-source packages or libraries are up to date. This means that, moving forward, software supply chain management becomes even more critical."
More information about software supply chain management practices and open source component quality can be found in the 2016 State of the Software Supply Chain Report.
Jan. 19, 2017 04:15 PM EST Reads: 5,394
Jan. 19, 2017 04:00 PM EST Reads: 5,422
Jan. 19, 2017 03:45 PM EST Reads: 1,781
Jan. 19, 2017 03:30 PM EST Reads: 1,025
Jan. 19, 2017 02:15 PM EST Reads: 1,043
Jan. 19, 2017 02:00 PM EST Reads: 4,773
Jan. 19, 2017 01:15 PM EST Reads: 5,661
Jan. 19, 2017 01:15 PM EST Reads: 5,155
Jan. 19, 2017 01:15 PM EST Reads: 3,520
Jan. 19, 2017 01:00 PM EST Reads: 3,763
Jan. 19, 2017 12:45 PM EST Reads: 6,355
Jan. 19, 2017 12:45 PM EST Reads: 2,537
Jan. 19, 2017 12:30 PM EST Reads: 1,190
20th Cloud Expo, taking place June 6-8, 2017, at the Javits Center in New York City, NY, will feature technical sessions from a rock star conference faculty and the leading industry players in the world. Cloud computing is now being embraced by a majority of enterprises of all sizes. Yesterday's debate about public vs. private has transformed into the reality of hybrid cloud: a recent survey shows that 74% of enterprises have a hybrid cloud strategy.
Jan. 19, 2017 12:15 PM EST Reads: 4,303
SYS-CON Events announced today that Linux Academy, the foremost online Linux and cloud training platform and community, will exhibit at SYS-CON's 20th International Cloud Expo®, which will take place on June 6-8, 2017, at the Javits Center in New York City, NY. Linux Academy was founded on the belief that providing high-quality, in-depth training should be available at an affordable price. Industry leaders in quality training, provided services, and student certification passes, its goal is to c...
Jan. 19, 2017 12:15 PM EST Reads: 2,003