WhiteSource releases report to shed light on current open source challenges and best practices for improving open source security management.
WhiteSource, the leader in open source security and license compliance management, announced today its first annual report on Open Source Security Vulnerability Management. The report findings, based on a survey of 650 developers from the US and Western Europe, and an analysis of the largest database of aggregated open source vulnerabilities, reveal that open source vulnerabilities have become the number one challenge for developers when working with open source components.
The survey results reveal that developers rated security as their top concern when dealing with open source components, above integration and functionality. What’s more, a developer invests an average of 15 hours a month dealing with open source security vulnerabilities, but only a small fraction of that time (25%) is devoted to actual remediation.
Research results also showed that Effective Usage Analysis, WhiteSource’s technology for prioritizing open source vulnerabilities based on their analyzed effectiveness, helped beta customers reduce the number of effective open source security vulnerabilities alerts by a substantial 85%, saving organizations a monthly average of 10 hours per developer.
Bruno Lavit, Senior release engineer at ForgeRock, participated in the beta testing and found the results very promising: “Effective Usage Analysis gives us the added value of faster remediation, with trace analysis that pinpoints the exact location of vulnerable dependencies.” Lavit added “This new capability enables us to significantly cut down on the time our developers spend dealing with open source vulnerability alerts.”
The full 2018 State of Open Source Vulnerability Management Report is available at https://www.mend.io/risk-report/.
Additional key findings in the report:
- Open source security vulnerabilities are on the rise: The data shows a significant 60% rise in the number of open source security vulnerabilities in 2017. This finding presents a serious challenge to development and security teams striving to meet security objectives.
- Developers are not managing open source vulnerabilities efficiently: Developers spend a lot of time addressing open source vulnerabilities, but the absence of standard practices and lack of developer‑focused tools result in an inefficient use of time.
- Prioritization is key to effective open source vulnerability management: Following a solid prioritization strategy for open source vulnerability remediation will save development teams time and money, and ensure they address the most critical issues first.
“Our findings show a sharp increase in the number of reported vulnerabilities in open source projects, which is taking a toll on developers who rely heavily on these components,” said David Habusha, VP Product at WhiteSource. “The research clearly shows that development teams cannot handle the influx of open source vulnerabilities and prioritization strategies and tools are becoming a necessity in order to properly secure applications.”