ynopsys , a leader in the

The findings of the report deliver an indepth look at the current state of open source security , compliance , licensing and code quality risks in commercial software with the goal of helping security , legal , risk and development teams better understand the open source security and license risk landscape . This year ’ s findings revealed an overwhelming majority of codebases ( 84 %) contain at least one known open source vulnerability , a nearly 4 % increase from last year .

The first step towards reducing business risk from open source , proprietary and commercial code involves a comprehensive inventory of all software a business uses , regardless of where it comes from or how it ’ s acquired . Only with this complete inventory – a Software Bill of Materials ( SBOM ) – can organisations establish a strategy to address risk stemming from new security disclosures like Log4Shell .

“ The report findings underscore the reality of open source as the underlying foundation of most types of software built today ,” said Jason Schmitt , General Manager of the Synopsys Software Integrity Group . “ An increase

in the average number of open source components further reinforces the importance of implementing a comprehensive SBOM that lists all open source components in your applications as well as their licenses , versions and patch status .”

Key findings include :

• A five-year overview of OSSRA data shows dramatic growth in open source use : The global pandemic contributed to the EdTech sector ’ s adoption of open source , which grew by 163 %, with educational courses and instructor / student interactions increasingly pushed online .

• High-risk vulnerabilities over the past five years have also increased at an alarming rate : Since 2019 , high risk vulnerabilities in the retail and e-commerce sector jumped by 557 %. Comparatively , the IoT sector , with 89 % of the total code being open source , saw a 130 % increase in highrisk vulnerabilities in the same period .

• Use of open source components with no licenses puts organisations at greater risk of violating copyright law than those using licensed components : The report found that 31 % of codebases are using open

source with no discernible license or with customised licenses . This is a 55 % increase from last year ’ s report . The lack of a license associated with open source code , or a variant of another open source license , may place undesirable requirements on the licensee and will often require legal evaluation for possible IP issues or other legal implications .

• Available code quality and security patches are not applied to a majority of codebases : Of the 1,480 audited codebases that included risk assessments , 91 % contained outdated versions of open source components . Unless an organisation keeps an accurate and up-to-date SBOM , an outdated component can be forgotten until it becomes vulnerable to a high-risk exploit .

“ The key to managing open source risk at the speed of modern development is maintaining complete visibility of application contents ,” said Mike McGuire , Senior Software Solutions Manager , Synopsys Software Integrity Group . “ By building this visibility into the application life cycle , businesses can arm themselves with the information needed to make informed , timely decisions regarding risk resolution .” u

intelligent SOFTWARE SECURITY

www . intelligentciso . com

61