Monday, May 17, 2021

Is Open Source Development Insecure?

One of the basic theories behind open source and its relative security is
the fact that many eyeballs are looking at code to identify potential and real trouble spots.
According to application security vendor Fortify Software, many eyeballs
alone aren’t enough. In fact Fortify argues in a new study that open source
software is insecure and is exposing enterprises to risk since secure
development processes have not been properly adopted.

Fortify’s study looked at 11 open source java projects and ran them through
a barrage of tests to identify secure practices. In general Fortify argued
that the projects had a variety of security vulnerabilities including Cross
Site Scripting and SQL injection flaws and that there was an overall lack of
secure development processes in place.

“We think that open source software is an area of under-explored risk that
we want to help enterprises better understand it,” Jacob West security
research group manager at Fortify told “We found
notable vulnerabilities in all of the eleven open source packages we looked
at. Because of the rampant numbers we found we think that open source
projects aren’t leveraging security tools properly.”

West added that across the projects they examined most did not make security
experts readily available to their users. He also argued that there was
also a lack of secure mechanisms for reporting and dealing with bugs. The
eleven projects that Fortify looked at include: Derby (relational database),
Geronimo (app server), Hibernate (object relational mapping tool), Hipergate
(CRM web application), JBoss Application server,
Jonas Application server, OFBiz E-Business solution web application,
OpenCMS Content management solution, Resin Application server, Struts Web
application framework and the Apache Tomcat app server.

Fortify has a degree of motivated self interest in open source Java
security. Since 2006, Fortify has run the Java Open Review
(JOR) project
which used Fortify’s static source code analysis tools to
identify bugs. Fortify claims that they’ve worked with over a hundred open
source projects to date to help them improve their code. West claimed that
so far JOR has found about 389 confirmed defects and approximately 357 have
been fixed as a direct result.

This article was first published on To read the full article, click here.

Similar articles

Latest Articles

How IBM has Changed...

Think is IBM’s big annual conference, and again this year, it was digital. I’m noticing a sharp quality difference in shows like this where...

Database-Tuning Platform Launches and...

PITTSBURGH — A team out of Carnegie Mellon University is launching its automatic database-tuning product today with the help of $2.5 million in funding.   OtterTune,...

Top 10 Professional Services...

Professional services automation (PSA) software aims to offer service-based companies most of the software they will need to run their businesses in one package....

What is Data Aggregation?

Data aggregation is the process where raw data is gathered and presented in a summarized format for statistical analysis. The data may be gathered...