Downloaded 26 times
![26 © 2015 Black Duck Software, Inc. All Rights Reserved.
HYGIENE?
hy·giene /ˈhīˌjēn/ [‘hai dji:n]
conditions or practices conducive to maintaining health and
preventing disease, especially through cleanliness.
synonyms: cleanliness, sanitation, sterility, purity,
disinfection](https://image.slidesharecdn.com/rv4secbillweinbergopensourcehygienepresentation-150714171904-lva1-app6891/85/RVAsec-Bill-Weinberg-Open-Source-Hygiene-Presentation-26-320.jpg)
![26 © 2015 Black Duck Software, Inc. All Rights Reserved.
HYGIENE?
hy·giene /ˈhīˌjēn/ [‘hai dji:n]
conditions or practices conducive to maintaining health and
preventing disease, especially through cleanliness.
synonyms: cleanliness, sanitation, sterility, purity,
disinfection](https://image.slidesharecdn.com/rv4secbillweinbergopensourcehygienepresentation-150714171904-lva1-app6891/75/RVAsec-Bill-Weinberg-Open-Source-Hygiene-Presentation-26-2048.jpg)
Uploaded byBlack Duck by Synopsys
RVAsec Bill Weinberg Open Source Hygiene Presentation
The presentation discusses the pervasive use of open source software (OSS) and the associated security, operational, and legal risks that arise from its development and deployment. It emphasizes the importance of 'open source hygiene'—practices for cross-referencing OSS components against known vulnerabilities to mitigate risks. Additionally, it highlights the growing need for automation in managing OSS security as vulnerabilities continue to increase.
More Related Content
![Planta pasteurizadora[1]](https://cdn.slidesharecdn.com/ss_thumbnails/plantapasteurizadora1-110119163025-phpapp01-thumbnail.jpg?width=600ounds&width=560&fit=bounds)
Similar to RVAsec Bill Weinberg Open Source Hygiene Presentation
More from Black Duck by Synopsys
RVAsec Bill Weinberg Open Source Hygiene Presentation
- 1. © 2014 BlackDuck Software, Inc. Proprietary & Confidential All Rights Reserved. OPEN SOURCE HYGIENE – MITIGATING SECURITY RISKS FROM DEVELOPMENT, INTEGRATION, DISTRIBUTION AND DEPLOYMENT OF OPEN SOURCE SOFTWARE Bill Weinberg, Senior Director, Open Source Strategy, Black Duck Software RVAsec – June 5, 2015
- 2. 2 © 2015Black Duck Software, Inc. All Rights Reserved. PRESENTATION ABSTRACT OSS Hygiene – Mitigating Security Risks from Development, Integration, Distribution and Deployment of Open Source Software Across the landscape of IT, Open Source Software (OSS) is pervasive and ubiquitous. From the cloud and web to data centers; from the desktop to mobile devices; and across a range of embedded and IoT applications, OSS commands an ever-increasing, dominant share of the system software stack and provides equally substantial swathes of enabling application middleware, applications themselves, and tooling. While rapid adoption of OSS demonstrably offers a range of advantages, the community development model presents developers, integrators and deployers with a set of accompanying challenges related to security, operational, and legal risk. Historically, foremost among these concerns stood license compliance and IP protection; however, with recent highly publicized threats to OSS, security has joined these concerns and today dominates the OSS adoption conversation. This presentation will explore the role of and requirements for secure development of and deployment with OSS.
- 3. 3 © 2015Black Duck Software, Inc. All Rights Reserved. YOUR SPEAKER Bill Weinberg, Senior Director, Open Source Strategy – Black Duck Software Bill helps Fortune 1000 clients create sound approaches to enable, build, and deploy software for intelligent devices, enterprise data centers, and cloud infrastructure. Working with FOSS since 1997, Bill also boasts more than thirty years of experience in embedded and open systems, telecommunications, and enterprise software. As a founding team-member at MontaVista Software, Bill pioneered Linux as leading platform for intelligent and mobile devices. During his tenure as Senior Analyst at OSDL (today, the Linux Foundation), Bill ran Carrier Grade and Mobile Linux initiatives and worked closely with foundation members, analyst firms, and the press. As General Manager of the Linux Phone Standards Forum, he worked tireless to establish standards for mobile telephony middleware. Bill is also a prolific author and busy speaker on topics spanning global FOSS adoption to real-time computing, IoT, legacy migration, licensing, standardization, telecoms infrastructure, and mobile applications. Learn more at http://www.linuxpundit.com/.
- 4. 4 © 2015Black Duck Software, Inc. All Rights Reserved. AGENDA • Open Source – Present and Future • The Open Source Vulnerability Landscape • The Open Source Development Model • Open Source Hygiene • Q&A
- 5. 5 © 2014Black Duck Software, Inc. Proprietary & Confidential All Rights Reserved. OPEN SOURCE IS UNSTOPPABLE The 2015 Future of Open Source Survey
- 6. 78% OF COMPANIES RUNON OPEN SOURCE LESS THAN 3% DON’T USE OSS IN ANY WAY CORPORATEUSE @FUTUREOFOSS #FUTUREOSS
- 7. CORPORATEUSE 2XSINCE 2010 USE OFOPEN SOURCE TO RUN BUSINESS IT ENVIRONMENTS HAS GONE UP @FUTUREOFOSS #FUTUREOSS
- 8. INCREASING ABUNDANCE Open SourceProjects Source: Black Duck Software BLACK DUCK KNOWLEDGEBASE 0 200000 400000 600000 800000 1000000 1200000 1400000 2007 2009 2011 2013 2015 CORPORATEUSE @FUTUREOFOSS #FUTUREOSS
- 9. OSS IMPACTS TECHNOLOGY CLOUDBIG DATA OPERATING SYSTEMS CONNECTED PRODUCT/IoT TECHNOLOGY @FUTUREOFOSS #FUTUREOSS OPEN SOURCE IS SO PERVASIVE THAT ALL SOFTWARE CATEGORIES USE IT OR HAVE DEPENDENCIES ON IT
- 10. THE SECURITY OF OPENSOURCE 55%SAID OPEN SOURCE DELIVERS SUPERIOR SECURITY 46%GIVE OSS FIRST CONSIDERATION AMONG SECURITY TECHNOLOGIES HOWEVER, 67%DON’T MONITOR OPEN SOURCE CODE FOR SECURITY VULNERABILITIES. SECURITY @FUTUREOFOSS #FUTUREOSS
- 11. 11 © 2014Black Duck Software, Inc. Proprietary & Confidential All Rights Reserved. THE OPEN SOURCE VULNERABILITY LANDSCAPE No worse (actually somewhat better) than other types of software
- 12. 12 © 2015Black Duck Software, Inc. All Rights Reserved. WORRIED ABOUT OPEN SOURCE SECURITY? “Through 2020, security and quality defects publicly attributed to OSS projects will increase significantly, driven by a growing presence within high-profile, mission-critical and mainstream IT workloads.” Gartner, Road Map for Open-Source Success: Understanding Quality and Security, Mark Driver, 3 March 2014.
- 13. 13 © 2015Black Duck Software, Inc. All Rights Reserved. Based on the National Vulnerability Database published by the National Institute of Standards and Technology (a repository by the U.S. government) THE GROWTH IN SECURITY VULNERABILITIES 0 1,000 2,000 3,000 4,000 5,000 6,000 7,000 8,000 9,000 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 CVEs (Vulnernabilities) by Year Jan 1, 2000 - May 11, 2015
- 14. 14 © 2015Black Duck Software, Inc. All Rights Reserved. OSS VULNERABILITY LANDSCAPE Of 9,200 security vulnerabilities reported in 2014, 4,000 affected open source code. – National Vulnerability Database & IBM X-Force
- 15. 15 © 2015Black Duck Software, Inc. All Rights Reserved. THE RISE OF “NAMED” VULNERABILITIES IN OSS
- 16. 16 © 2015Black Duck Software, Inc. All Rights Reserved. PENDING LEGISLATION – H.R. 5793 THE CYBER SUPPLY CHAIN TRANSPARENCY AND REMEDIATION ACT (“THE ROYCE BILL”) 3 Key Provisions: • Vendors must provide a Bill of Materials of 3rd-Party and Open Source Components (including versions) • Vendors cannot use known vulnerable components if there is a less vulnerable component available • Software must be patchable/updateable (to address new vulnerabilities when they are discovered)
- 17. 17 © 2014Black Duck Software, Inc. Proprietary & Confidential All Rights Reserved. THE OPEN SOURCE DEVELOPMENT MODEL Inherently (in)secure?
- 18. 18 © 2015Black Duck Software, Inc. All Rights Reserved. LINUS’ LAW Given enough eyeballs, all bugs are shallow
- 19. 19 © 2015Black Duck Software, Inc. All Rights Reserved. User Community & Ecosystem Developer Community Core Developers OPEN SOURCE DEVELOPMENT MODEL • Core project developers create, maintain, curate code base • Vet contributions from larger communities • Focus on project goals – features, performance, etc. Code
- 20. 20 © 2015Black Duck Software, Inc. All Rights Reserved. User Community & Ecosystem Developer Community Core Developers OPEN SOURCE CODE CURATION MODEL Code v1 Code v2 Code vN CONTINUOUS INCREMENTAL IMPROVEMENT
- 21. 21 © 2015Black Duck Software, Inc. All Rights Reserved. OPEN SOURCE CODE QUALITY ASSURANCE CODE unterminated strings unchecked function returns Indices out of bounds memory leaks faulty logic misconfigurationregressions stray pointersback doors parameter reversal improper type castsincorrect permissions debug coderace conditions deprecated versions priority inversion unitialized variablesprivilege violations COMMUNITY Maintainers, developers, users exercise, debug & improve code
- 22. 22 © 2015Black Duck Software, Inc. All Rights Reserved. THEORETICAL “TRIPLE FENCE” OF OSS SECURITY Enterprise / OEM Integration Distribution / Platform Creation OSS Project Purview Production Code
- 23. 23 © 2015Black Duck Software, Inc. All Rights Reserved. OPEN SOURCE CODE SECURITY GAP • Majority of eyes occupied elsewhere • Minority of community is security-savvy CODE unterminated strings unchecked function returns Indices out of bounds memory leaks faulty logic misconfigurationregressions stray pointersback doors parameter reversal improper type castsincorrect permissions debug coderace conditions deprecated versions priority inversion unitialized variablesprivilege violations COMMUNITY
- 24. 24 © 2015Black Duck Software, Inc. All Rights Reserved. • Use-case specific errors • Local misconfiguration • LAN-based vulnerabilities • Deployed deprecated s/w versions • Weak encryption • Bad authentication • Stolen credentials • Viruses, Trojans & other malware • Denial of service attacks • Weak passwords • Unenforced security policy • Phishing • Man-in-the-middle attacks • Forged certificates • Spoofed MACs and IP addresses • Latent zero-day exploits • Brute force decryption THREATS RESISTANT TO COMMUNITY OVERSIGHT
- 25. 25 © 2014Black Duck Software, Inc. Proprietary & Confidential All Rights Reserved. OPEN SOURCE HYGIENE Component-level best practices for securing open source software
- 26. 26 © 2015Black Duck Software, Inc. All Rights Reserved. HYGIENE? hy·giene /ˈhīˌjēn/ [‘hai dji:n] conditions or practices conducive to maintaining health and preventing disease, especially through cleanliness. synonyms: cleanliness, sanitation, sterility, purity, disinfection
- 27. 27 © 2014Black Duck Software, Inc. Proprietary & Confidential All Rights Reserved. Open Source Hygiene?
- 28. 28 © 2014Black Duck Software, Inc. Proprietary & Confidential All Rights Reserved. Open Source Hygiene is the practice of cross referencing the open source content of a company or product software stack, module by module, version by version, with databases of known vulnerabilities of those software components.
- 29. 29 © 2015Black Duck Software, Inc. All Rights Reserved. SECURITY TECHNOLOGIES – WHERE DOES OSS HYGIENE FIT? Intrusion Detection End-point Security Network Security Certifiable Systems Formal Verification Authentication Code Quality Tools Binary Obfuscation Encryption Capabilities & Access Control Policy Enforcement Patch/Update Management Configuration Management Auditing & Logging Physical Security Hardware Mechanisms
- 30. 30 © 2015Black Duck Software, Inc. All Rights Reserved. OSS HYGIENE - VULNERABILITY DETECTION AND REMEDIATION Intrusion Detection End-point Security Network Security Certifiable Systems Formal Verification Authentication Code Quality Tools Binary Obfuscation Encryption Capabilities & Access Control Policy Enforcement Patch/Update Management Configuration Management Auditing & Logging Physical Security Hardware Mechanisms Open Source Hygiene
- 31. 31 © 2015Black Duck Software, Inc. All Rights Reserved. Software Composition Analysis (SCA) YET ANOTHER SECURITY TECHNOLOGY TERM
- 32. 32 © 2015Black Duck Software, Inc. All Rights Reserved. VERSIONS AND VULNERABILITIES Component Version Component Version Component Version Component Version Component Version BOM Newer = More Secure
- 33. 33 © 2015Black Duck Software, Inc. All Rights Reserved. EXAMPLE ENTERPRISE SOFTWARE BUILD (CI) WORKFLOW Developer Source Code Artifact Repository 1. Request Build 2. Fetch Sources 3. Resolve Dependen- cies 5. Publish Artifacts, Build Metadata 6. Build Results 4. Perform Build
- 34. 34 © 2015Black Duck Software, Inc. All Rights Reserved. EXAMPLE ENTERPRISE SOFTWARE BUILD (CI) WORKFLOW Developer Source Code Artifact Repository 1. Request Build 2. Fetch Sources 3. Resolve Dependen- cies 5. Publish Artifacts, Build Metadata 6. Build Results 4. Perform Build OSS
- 35. 35 © 2015Black Duck Software, Inc. All Rights Reserved. OSS HYGIENE COMPLEMENTS SECURITY TESTING ANALYZE DESIGN CODE TEST MAINTAIN Static Analysis Dynamic Analysis Penetration Testing Rule-based Vulnerability Testing OSS POLICIES OSS SELECTION OSS DETECTION OSS ALERTING OSS MONITORING OPEN SOURCE HYGIENE SOFTWARE DEVELOPMENT LIFE-CYCLE RELEASE
- 36. 36 © 2015Black Duck Software, Inc. All Rights Reserved. Technical • Vulnerability db schemas • Integration in workflows • Build tools, manifests • Scan cycle time/speed • 100s build/day • DevOps • Comprehensive scanning • Sheer volume • Repo locations • Language support • Modified OSS & snippets • Missing versioning • Source and Binary Social / Managerial • OSS management policy • “Organic” OSS selection, ingress and integration • Industry norms • Can’t/won’t remediate • Architecture issues • Version dependencies • Using forked versions • Warning fatigue • Hundreds or thousands of OSS components OSS HYGIENE CHALLENGES
- 37. 37 © 2015Black Duck Software, Inc. All Rights Reserved. Extenuating Factors • Regulated/Unregulated (cuts both ways) • Dependence on CVSS in triage (simplistic / misleading) • Impact of social media (Tweets correlate with exploits) REMEDIATION TIMES BY INDUSTRY 0 50 100 150 200 Cloud Infrastructure Education Financial Services Healthcare Daystoremediate Source: NopSec
- 38. 38 © 2015Black Duck Software, Inc. All Rights Reserved. THE ROAD TO SECURE OSS USE – BEST PRACTICES Identify OSS in use Map known vulnerabilities ID and assess risk Monitor for new vulnerabilities Review vuln details Assess CVE impact Rank / tier app risk Triage and develop remediation plan Track remediation Inventory & track usage Configure risk policies and actions Determine approval request workflow and management
- 39. 39 © 2015Black Duck Software, Inc. All Rights Reserved. OSS REMEDIATION / TRIAGE CONSIDERATIONS Comparable to other types of software • Severity of vulnerability (CVSS and other rankings) • Number of vulnerabilities / component • Existence/availability of exploits (if known) • Context of vulnerability (internet/customer facing vs. internal) • Availability of patches or other remediation • Existence of comparable functionality in alternate OSS tech • Willingness / capability to patch / maintain OSS forks
- 40. 40 © 2015Black Duck Software, Inc. All Rights Reserved. Manual Procedure Automated Process Speed Slow Faster Timeliness Seldom Automatic Accuracy Low High Comprehensiveness With Difficulty Configurable Latency Weeks / Months Hours Workflow Impact Disruptive Transparent Repeatable / Traceable Almost Never Always Remediation Subjective Policy-based Cost FTEs CapEx / OpEx OSS HYGIENE – THE NEED FOR AUTOMATION
- 41. 41 © 2015Black Duck Software, Inc. All Rights Reserved. • Scan code to automatically identify open source in use • Map known security vulnerabilities • Assess licenses, versions, community activity (operational risk) • Identify open source in use with potential high-risk IDENTIFY VULNERABILITIES IN OSS SOFTWARE PORTFOLIOS
- 42. 42 © 2015Black Duck Software, Inc. All Rights Reserved. REMEDIATION DASHBOARDS • Review CVSS and its impact on each project • Assess, triage and prioritize vulnerabilities • Schedule and track planned and actual remediation dates
- 43. 43 © 2015Black Duck Software, Inc. All Rights Reserved. Benefits • Brings OSS components up to date • Breaks open 3rd party code box • Also fights version proliferation Limitations • Only effective as current version / patch set • Effective for OSS only • Primary focus on source code (cf. BAT) OSS HYGIENE – PROS AND CONS
- 44. 44 © 2015Black Duck Software, Inc. All Rights Reserved. CONCLUSION OSS Hygiene addresses a critical function in application security • Focus on version deprecation as a source of vulnerabilities • Streamlines identification and remediation of exploitable OSS components OSS Hygiene is NOT • Source code analysis tool or method (it uses community resources) • A replacement for other security tools (it complements them) • A marketing gimmick (real organizations present real requirements) OSS Hygiene is an actionable methodology • Can be implemented manually and/or with tools/mechanisms in place • Benefits from fast and accurate scanning of software portfolios • Best when employed as part of disciplined OSS management practices
- 45.
Editor's Notes
- #5 Good morning. Today we will be discussing some of the key trends, challenges and considerations in managing Open Source Software. I will present for you an introduction to OSS Logistics – Black Duck’s framework for managing OSS within an organization. We will leave time for questions at the end of the presentation, but please feel free to interrupt me if you have questions as we go along.
- #7 Hot off the press: 2015 Future Of Open Source Study results! #futureOSS http://bit.ly/FOOS2015@north_bridge @black_duck_sw
- #19 “Every motivation that makes a person do something can be classified under "survival", "social life" or "entertainment”. As a result, progress is defined as reaching a higher category; that is, not doing a thing merely for survival, but for social reasons, and then, even better, just for fun – Linus Torlvald, The Hacker Ethic and the Spirit of the Information Ag
- #31 Code Quality Tools Over half of all vulnerabilities come from basic programming errors and s/w faults Black Duck OSS security participates in code quality by highlighting need to update to newer, higher-quality versions of OSS projects Patch / Update Management Modern enterprise and embedded systems and applications include field update capabilities Black Duck OSS security helps OEMs, SPs and end-users integrate the latest and most secure versions of OSS technologies in patch sets and updates Configuration Management - Many vulnerabilities and exploits leverage poorly configured systems and applications Black Duck OSS security helps integrators and others ensure that current configurations include the most up-to-date OSS s/w components Policy Enforcement Security policy extends from production systems back to development and build Black Duck OSS security ensures that only policy-compliant versions of OSS components are integrated into production software
- #34 walkthrough of Build Flow diagram which factors are most important to T.Rowe Price in choosing a build automation platform?
- #35 walkthrough of Build Flow diagram which factors are most important to T.Rowe Price in choosing a build automation platform?
- #36 This slide demonstrates that BDS can be used across all stages of the SDL, including after release w/o additional testing, while other testing tools are limited to specific phases of the SDL The next slide shows details
- #39 Identify the open source code your company has in use. Before you can begin remediating vulnerabilities, you have to gather and maintain a knowledge of what components you have in use and where. Automated code scanning tools that produce a software BoM or “Bill of Materials” – i.e. a listing of open source components and versions contained in an application – are the best approach for organizations seeking a thorough evaluation of their code bases. Discover known vulnerabilities present in your open source code. There are resources, like the U.S. Government’s National Vulnerability Database (NVD), that track and publically report on security vulnerabilities for all types of software. Yet, more comprehensive and timely notifications can be provided through automated tools that can map vulnerabilities from sources like the NVD and VulnDB, directly to the code your company is using in its applications via the BoM. Assess and remediate components with vulnerabilities. Every organization is going to have a different approach to assessing potential threats and determining those that require immediate remediation. Developing a triage model can help security teams quickly prioritize vulnerabilities based on criteria such as the severity or exploitability of the vulnerability in conjunction with the sensitivity of the applications impacted. Monitor for new vulnerabilities. A security professional’s work is never done. Once a vulnerability is quickly and properly patched and remediated, another is likely on the horizon posing a potentially more damaging threat. Continuous, automated scans of applications under development can identify open source entering the code base and ensure that vulnerabilities aren’t being unknowingly introduced along with it. In addition, by monitoring for newly disclosed vulnerabilities and having the ability to immediately assess their impact across your code base will help your company’s security, compliance, and development teams gain peace of mind knowing they are actively managing security threats.