Application security is a strategic imperative for organizations developing internal and public-facing software. Exploits of software security vulnerabilities can result in loss of customer or company information, disruption of business operations, damage to public image, regulatory penalties, and costly litigation.

Adding to the management challenge, the software development life cycle (SDLC) is increasingly complex. Demands for agility and faster time to market, distributed development teams, and rapidly evolving languages and technologies are all contributing factors.

To remain competitive, development teams increasingly rely on open source software—cost-effective, reusable software building blocks created and maintained by global communities of developers.

Open source use isn’t risky, but unmanaged use of open source is.

Open source software forms the backbone of nearly every application in every industry. Chances are that includes the applications your company develops as well. If you can’t produce an accurate inventory of the licenses, versions, and patch status of the open source components in your applications, it’s time to assess your open source management policies.

This paper provides insights and recommendations to help organizations and their development and IT teams better manage the open source risk landscape. It covers:

• Open source license risk and the need to identify and catalog open source licenses.
• Security risk that comes with open source use and inadequate vulnerability management.
• Operational open source risk, version control, and the dangers of using inactive components.

Can you say with confidence that the open source components used in your applications are up-to-date with all crucial patches applied? It’s impossible to patch software when you don’t know you’re using it.

The 2019 OSSRA report offers an in-depth look at the state of open source security, compliance, and code quality risk in commercial software. Based on the anonymized data of over 1,200 audited codebases, this report provides:

• The latest insights and surprising statistics about open source security and license risk.
• The components most likely to have identified vulnerabilities.
• Six key recommendations to improve your application risk management processes.