WhiteSource, the leader in open source security and license compliance management, announced today its first annual report on Open Source Security Vulnerability Management. The report findings, based on a survey of 650 developers from the US and Western Europe, and an analysis of the largest database of aggregated open source vulnerabilities, reveal that open source vulnerabilities have become the number one challenge for developers when working with open source components.
The survey results reveal that developers rated security as their top concern when dealing with open source components, above integration and functionality. What’s more, a developer invests an average of 15 hours a month dealing with open source security vulnerabilities, but only a small fraction of that time (25%) is devoted to actual remediation.
Research results also showed that Effective Usage Analysis, WhiteSource’s technology for prioritizing open source vulnerabilities based on their analyzed effectiveness, helped beta customers reduce the number of effective open source security vulnerabilities alerts by a substantial 85%, saving organizations a monthly average of 10 hours per developer.
Bruno Lavit, Senior release engineer at ForgeRock, participated in the beta testing and found the results very promising: “Effective Usage Analysis gives us the added value of faster remediation, with trace analysis that pinpoints the exact location of vulnerable dependencies.” Lavit added “This new capability enables us to significantly cut down on the time our developers spend dealing with open source vulnerability alerts.”
The full 2018 State of Open Source Vulnerability Management Report is available at https://www.mend.io/open-source-vulnerability-management-report/.
Additional key findings in the report:
“Our findings show a sharp increase in the number of reported vulnerabilities in open source projects, which is taking a toll on developers who rely heavily on these components,” said David Habusha, VP Product at WhiteSource. “The research clearly shows that development teams cannot handle the influx of open source vulnerabilities and prioritization strategies and tools are becoming a necessity in order to properly secure applications.”