Synopsys OSSRA report provides in-depth analysis of open source adoption trends and patterns

Much software is built on a foundation of reusable open source components. But those who use open source often overlook the associated security and licensing risks. Software developers often take code from open source repositories to embed in their company's products and speed up the development process. While the efficiency gains and cost savings of code reuse are clear, enterprises rarely regularly review open source code for potential security and legal issues. Few companies manage their developers' use of open source. As a result, they remain unaware of their open source risks and obligations.

Synopsys, Nasdaq: SNPS , recently released the 2019 Open Source Security and Risk Analysis (OSSRA) report . The report, produced by the Synopsys Cybersecurity Research Center (CyRC), reviewed the audit results of more than 1,200 commercial applications and libraries performed by the Black Duck Audit Services team. The report highlights trends and patterns in open source applications, as well as the prevalence of insecure open source components and license conflicts.

The report shows that enterprises are now facing challenges in managing open source application risks, and these challenges have been evident in the past few years. However, the data also shows that an inflection point has been reached, and many enterprises have improved their ability to manage open source risks due to increased risk awareness and the maturity of commercial software component analysis solutions.

"Open source plays an increasingly important role in modern software development and deployment, but to realize its value, organizations need to understand and manage how it impacts their risk posture from a security and license compliance perspective," said Tim Mackey, principal security strategist at the Synopsys Cybersecurity Research Center. "The 2019 OSSRA report provides an overview of the state of open source risk management in commercial applications. The report shows that significant challenges remain, with the vast majority of applications containing open source security vulnerabilities and license conflicts, but also highlights that these challenges are solvable, as the number of open source vulnerabilities and license conflicts decreased compared to last year."

The most notable open source risk trends in the 2019 OSSRA report include:

● Open source adoption has increased significantly. 96% of the code bases audited in 2018 contained open source components, with an average of 298 open source components per code base, compared to 257 in 2017.

● Open source license conflicts can put intellectual property at risk. 68% of code bases contain some form of open source license conflict, and 38% contain open source components without a recognizable license.

● Use of “abandoned” components is common. 85% of codebases contain components that are older than four years or have not been developed in the past two years. If a component is inactive or unmaintained, it means that no one is addressing its potential vulnerabilities.

● Many organizations fail to patch or update their open source components. The average age of vulnerabilities identified in the 2018 Black Duck audit was 6.6 years, slightly higher than in 2017. This suggests that remediation efforts have not improved significantly. 43% of code bases scanned in 2018 contained vulnerabilities that were more than ten years old. The National Vulnerability Database showed 16,500 new vulnerabilities added in 2018, and its explicit patching process needs to expand to accommodate the increase in disclosed vulnerabilities.

● Not all vulnerabilities are equal, but many organizations don’t even address the riskiest ones. More than 40% of code bases contain at least one high-risk open source vulnerability.

The report shows that the use of open source software is not a problem in itself, in fact, it is critical to software innovation. However, failure to proactively identify and manage any security and license risks associated with the use of open source components can be extremely destructive. While risk factors still exist, the 2019 OSSRA report data shows that after the Equifax data breach, the increase in open source risk awareness and the maturity of commercial software component analysis solutions have made progress:

Enterprises  are getting better at managing open source security vulnerabilities. 60% of code bases audited in 2018 contained at least one vulnerability, an improvement from 78% in 2017.

 Open source license compliance has also improved overall, with 68% of codebases audited in 2018 containing components with conflicting licenses, compared to 74% in 2017 .