In a report released recently by Snyk and Linux Foundation, there are more vulnerabilities that developers admit to be exposed to. The report is based on a survey of over 550 respondents in the first quarter of 2022 as well as data from Snyk Open Source, which has scanned more than 1.3B open source projects.
Snyk, the leader in developer security, has collaborated with The Linux Foundation, a global nonprofit organisation enabling innovation through open source, to come out with some startling discoveries on The State of Open Source Security.
This first-of-its-kind report details the significant security risks resulting from the widespread use of open source software within modern application development as well as how many organisations are currently ill-prepared to effectively manage these risks. Specifically, the report found:
- Over four out of every ten (41%) organisations don't have high confidence in their open source software security;
- Three in ten (30%) organisations without an open source security policy openly recognize that no one on their team is currently directly addressing open source security.
- The average application development project has 49 vulnerabilities and 80 direct dependencies (open source code called by a project); and,
- The time it takes to fix vulnerabilities in open source projects has steadily increased, more than doubling from 49 days in 2018 to 110 days in 2021.
Dangers from code reuse
“Software developers today have their own supply chains – instead of assembling car parts, they are assembling code by patching together existing open source components with their unique code. While this leads to increased productivity and innovation, it has also created significant security concerns,” said Matt Jarvis, Director, Developer Relations, Snyk. The report found widespread evidence suggesting industry naivety about the state of open source security today.
Specifically, the report found:
“Software developers today have their own supply chains – instead of assembling car parts, they are assembling code by patching together existing open source components with their unique codes. While this leads to increased productivity and innovation, it has also created significant security concerns,” said Matt Jarvis, Director, Developer Relations, Snyk.
“This first-of-its-kind report found widespread evidence suggesting industry naivety about the state of open source security today. Together with The Linux Foundation, we plan to leverage these findings to further educate and equip the world’s developers, empowering them to continue building fast, while also staying secure.”
“While open source software undoubtedly makes developers more efficient and accelerates innovation, the way modern applications are assembled also makes them more challenging to secure,” said Brian Behlendorf, General Manager, Open Source Security Foundation
(OpenSSF). “This research clearly shows the risk is real, and the industry must work even more closely together in order to move away from poor open source or software supply chain security practices.”
41% of organisations don't have high confidence in open source software security
Modern application development teams are leveraging code from all sorts of places. They reuse code from other applications they’ve built and search code repositories to find open source components that provide the functionality they need. The use of open source requires a new way of thinking about developer security that many organizations have not yet adopted.
● Less than half (49%) of organisations have a security policy for OSS development or usage (and this number is a mere 27% for medium-to-large companies); and,
● Three in ten (30%) organisations without an open source security policy openly recognise that no one on their team is currently directly addressing open source security.
Average application development project: 49 vulnerabilities spanning 80 direct dependencies
When developers incorporate an open source component in their applications, they immediately become dependent on that component and are at risk if that component contains vulnerabilities. The report shows how real this risk is, with dozens of vulnerabilities discovered across many direct dependencies in each application evaluated.
This risk is also compounded by indirect, or transitive, dependencies, which are the dependencies of your dependencies. Many developers do not even know about these dependencies, making them even more challenging to track and secure.
That said, to some degree, survey respondents are aware of the security complexities created by open source in the software supply chain today:
● Over one-quarter of survey respondents noted they are concerned about the security impact of their direct dependencies;
● Only 18% of respondents said they are confident of the controls they have in place for their transitive dependencies; and,
● Forty percent of all vulnerabilities were found in transitive dependencies.
Time to fix: More than doubled from 49 Days in 2018 to 110 days in 2021
As application development has increased in complexity, the security challenges faced by development teams have also become increasingly complex. While this makes development more efficient, the use of open source software adds to the remediation burden. The report found that fixing vulnerabilities in open source projects takes almost 20% longer (18.75%) than in proprietary projects.
