One of the basic theories behind open source and its relative security is
the fact that many eyeballs are looking at code to identify potential and real trouble spots.
According to application security vendor Fortify Software, many eyeballs
alone aren’t enough. In fact Fortify argues in a new study that open source
software is insecure and is exposing enterprises to risk since secure
development processes have not been properly adopted.
Fortify’s study looked at 11 open source java projects and ran them through
a barrage of tests to identify secure practices. In general Fortify argued
that the projects had a variety of security vulnerabilities including Cross
Site Scripting and SQL injection flaws and that there was an overall lack of
secure development processes in place.
“We think that open source software is an area of under-explored risk that
we want to help enterprises better understand it,” Jacob West security
research group manager at Fortify told InternetNews.com. “We found
notable vulnerabilities in all of the eleven open source packages we looked
at. Because of the rampant numbers we found we think that open source
projects aren’t leveraging security tools properly.”
West added that across the projects they examined most did not make security
experts readily available to their users. He also argued that there was
also a lack of secure mechanisms for reporting and dealing with bugs. The
eleven projects that Fortify looked at include: Derby (relational database),
Geronimo (app server), Hibernate (object relational mapping tool), Hipergate
(CRM web application), JBoss Application server,
Jonas Application server, OFBiz E-Business solution web application,
OpenCMS Content management solution, Resin Application server, Struts Web
application framework and the Apache Tomcat app server.
Fortify has a degree of motivated self interest in open source Java
security. Since 2006, Fortify has run the Java Open Review
(JOR) project which used Fortify’s static source code analysis tools to
identify bugs. Fortify claims that they’ve worked with over a hundred open
source projects to date to help them improve their code. West claimed that
so far JOR has found about 389 confirmed defects and approximately 357 have
been fixed as a direct result.
This article was first published on InternetNews.com. To read the full article, click here.
Ethics and Artificial Intelligence: Driving Greater Equality
FEATURE | By James Maguire,
December 16, 2020
AI vs. Machine Learning vs. Deep Learning
FEATURE | By Cynthia Harvey,
December 11, 2020
Huawei’s AI Update: Things Are Moving Faster Than We Think
FEATURE | By Rob Enderle,
December 04, 2020
Keeping Machine Learning Algorithms Honest in the ‘Ethics-First’ Era
ARTIFICIAL INTELLIGENCE | By Guest Author,
November 18, 2020
Key Trends in Chatbots and RPA
FEATURE | By Guest Author,
November 10, 2020
FEATURE | By Samuel Greengard,
November 05, 2020
ARTIFICIAL INTELLIGENCE | By Guest Author,
November 02, 2020
How Intel’s Work With Autonomous Cars Could Redefine General Purpose AI
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
October 29, 2020
Dell Technologies World: Weaving Together Human And Machine Interaction For AI And Robotics
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
October 23, 2020
The Super Moderator, or How IBM Project Debater Could Save Social Media
FEATURE | By Rob Enderle,
October 16, 2020
FEATURE | By Cynthia Harvey,
October 07, 2020
ARTIFICIAL INTELLIGENCE | By Guest Author,
October 05, 2020
CIOs Discuss the Promise of AI and Data Science
FEATURE | By Guest Author,
September 25, 2020
Microsoft Is Building An AI Product That Could Predict The Future
FEATURE | By Rob Enderle,
September 25, 2020
Top 10 Machine Learning Companies 2021
FEATURE | By Cynthia Harvey,
September 22, 2020
NVIDIA and ARM: Massively Changing The AI Landscape
ARTIFICIAL INTELLIGENCE | By Rob Enderle,
September 18, 2020
Continuous Intelligence: Expert Discussion [Video and Podcast]
ARTIFICIAL INTELLIGENCE | By James Maguire,
September 14, 2020
Artificial Intelligence: Governance and Ethics [Video]
ARTIFICIAL INTELLIGENCE | By James Maguire,
September 13, 2020
IBM Watson At The US Open: Showcasing The Power Of A Mature Enterprise-Class AI
FEATURE | By Rob Enderle,
September 11, 2020
Artificial Intelligence: Perception vs. Reality
FEATURE | By James Maguire,
September 09, 2020
Datamation is the leading industry resource for B2B data professionals and technology buyers. Datamation's focus is on providing insight into the latest trends and innovation in AI, data security, big data, and more, along with in-depth product recommendations and comparisons. More than 1.7M users gain insight and guidance from Datamation every year.
Advertise with TechnologyAdvice on Datamation and our other data and technology-focused platforms.
Advertise with Us
Property of TechnologyAdvice.
© 2025 TechnologyAdvice. All Rights Reserved
Advertiser Disclosure: Some of the products that appear on this
site are from companies from which TechnologyAdvice receives
compensation. This compensation may impact how and where products
appear on this site including, for example, the order in which
they appear. TechnologyAdvice does not include all companies
or all types of products available in the marketplace.