Open source code has conquered the world of software. Almost every website, API, and application is built on an enormous stack of open source libraries and frameworks that totals many millions of lines of code. Millions of corporations and developers are taking advantage of the expansive array of components, zero cost, and easy integration to create more-sophisticated software far faster than building it themselves.
I am a huge advocate of open source and have led several very successful open source projects. But along with all the benefits of open source components, we have to recognize some new risks. There are millions of these libraries in all the different software languages, such as Java, .NET, Ruby, Python, Go, and many more. Dozens of new vulnerabilities are discovered every week, but we’re only scratching the surface. The problem is that only a handful of talented security researchers are doing the highly skilled work of testing this code.
That means that there are, almost certainly, large numbers of latent vulnerabilities in open source software. Having a researcher discover one of these and publish it seems like an expensive fire drill for companies, because they have to search to see if they're using the library, replace it, recode their application to match, retest, resecure, and redeploy. But if a malicious actor finds the vulnerability and starts attacking companies with it, the damage can be much more expensive. Web applications and web APIs run with almost full privilege inside a company's data center, and all that open source inherits the power to do anything the application can do.
Bad actors have recognized the power of the software supply chain attack vector. If finding a vulnerability gets too hard, they can switch to attacking the open source projects themselves. For example, they could simply join a project and contribute code that contains or creates a weakness. Or they could target the open source repositories cloning an existing library, introduce malicious code, and make it available with a similar name as the original. Hackers have even targeted the development "tool chain" to inject their code into binaries. In all these examples, developers and end users alike would not see the attack happening in their data center, but they would be completely owned.
The ramifications of this are staggering. If an attacker was able to infiltrate a popular library like log4j, they would very quickly be running with privilege inside most data centers in the world. They could use this access to not only attack the targeted application but as an internal launching point for attacks on the organization's internal network. And that's just a single library. This is the easiest path to seriously disrupting the Internet and harming huge numbers of people.
Organizations need to minimize their exposure and establish the capability to respond to novel vulnerabilities and attacks within hours. Unfortunately, most organizations take months to respond and are very exposed in the interim. Every company that is betting their future on software needs to have a strategy for beefing up the security of their software supply chain. Here are a few practical tips:
- Exercise Restraint: Don't allow just any random library into your supply chain. Remember that you are betting your company on the security of that code. Set and enforce some policies around the types of code you will allow. Look for projects with high popularity, active committers, and evidence of process — including security.
- Establish Guardrails: Create guidelines for secure use of the libraries you select for use. Define how you expect each library to be used, and detail how developers should safely install, configure, and use each library in their code. Also, be sure to identify dangerous methods and how to use them safely.
- Constant Vigilance: Establish continuous self-inventory so you know exactly what open source libraries you are using in your inventory. Ensure that you have a notification system in place, so you know exactly what applications and servers are affected by new vulnerabilities.
- Runtime Protection: Use runtime application security protection (RASP) to prevent both "known" and "unknown" library vulnerabilities from being exploited. If novel vulnerabilities are disclosed, your RASP infrastructure enables you to respond in minutes, not weeks or months.
In an age of "digital transformation initiatives" your software supply chain is the key to creating and deploying applications quickly. Please make sure you don't inadvertently undermine your entire business in the rush to reinvent it.
- 10 Open Source Security Tools You Should Know
- Spot the Bot: Researchers Open-Source Tools to Hunt Twitter Bots
- Secure Code: You Are the Solution to Open Source's Biggest Problem
- Best Practices for Securing Open Source Code
Learn from the industry's most knowledgeable CISOs and IT security experts in a setting that is conducive to interaction and conversation. Early-bird rate ends August 31. Click for more info.