Navigating the Risks and Awards of Open-Source Software for Product Owners

As technology evolves at a breakneck pace, so do the challenges that product owners face in safeguarding their creations. In this ongoing series, we delve into the intricate world of product security, illuminating the strategies and insights every Product Owner should possess. In our inaugural article, we ventured into the realm of threat analysis and the STRIDE method. Now, in this installment, we’ll touch on open-source vulnerabilities, ways to detect potential risks, and using checks in the build process to avoid releasing vulnerable code.

Using open-source software in commercial products can offer numerous benefits, such as cost and time savings through readily available code, and access to a vibrant developer community, but it also comes with several risks that businesses should carefully consider. These can include:

Looking more deeply into Security Vulnerabilities, then one of the more talked about attack vectors currently is called supply chain hacking (1). This is where attackers compromise open-source software by injecting malicious code into popular libraries or repositories. This can result in hostile actors targeting and compromising a trusted supplier or service provider to gain unauthorized access or control over a target organization's systems or data. These attacks exploit the trust established between organizations and their suppliers. This can go unnoticed for extended periods and impact many downstream products, products, or services.

This type of attack can be conducted several ways, firstly via “typosquatting” which is a method that relies on people misspelling a package name and consequently downloading malicious code. The attack in the linked article exploited “dependency confusion” (2) and did not need the victim to perform any action.

The chief concern with open-source components is that they can contain security vulnerabilities that may not receive immediate updates. Integrating outdated or poorly maintained open-source code can expose your commercial software to security risks and potential breaches. Vulnerabilities in an inactive project may mean no fix is ever released and potentially you’ll not even receive a notification of the exposure.

Another concern is that you might not even be aware that open-source software is used within your codebase. Via indirect dependencies you might use components inadvertently through other dependencies. These indirect dependencies can make it challenging to track vulnerabilities in a comprehensive manner. If you've made custom modifications to open-source code in your project, you might not receive automatic updates and might not be aware of vulnerabilities in the original codebase.

One technique to alleviate the risk in open-source software is to use dependency tracking software, also known as dependency management tools or dependency scanners. These help product owners, developers and organizations manage and monitor the dependencies in their software projects, including open-source libraries and components. These tools can be invaluable in identifying and addressing open-source vulnerabilities.

Essentially these tools have three main functions, they identify dependencies by automatically detecting and listing all the third-party libraries and components that your software relies on, including open-source ones. From this its then possible to look at the versions of each dependency used in your project, products, products, or services, ensuring you are aware and able to manage what is currently in use. Once the dependency and version are known then it’s possible to perform vulnerability scanning. Many of these dependency tracking tools integrate with databases of known vulnerabilities (3), such as the National Vulnerability Database (NVD) or within the programming language ecosystems where known issues with SQL injection or deployment failures are listed.

As a product owner you can utilize a dependency tracking software tool in your development process to assist you with risk assessment, as the tools will categorize each vulnerability found by severity, helping you prioritize which issues to address first.

By incorporating dependency tracking software into your continuous integration/continuous deployment (CI/CD) pipeline you can set it up so that it repeatedly scans the codebase for risks and fails the build process when known vulnerabilities over a set threshold are found. This failed build will need to be addressed before it can be merged and promoted.

However, in defiance of open-source software a Product Owner can benefit hugely from the community, via:

As a Product Owner, it's vital to acknowledge that your codebase likely harbors hidden gems of open-source software, brimming with possibilities and pitfalls. These code snippets come with a dual nature—offering time savings and convenience while carrying potential vulnerabilities. The good news is, by knowing that there are tools to help you address these risks and processes you can put in place to minimise the chances of releasing vulnerable code, your journey to ensuring that your software ships smoothly is plain sailing.

Links:

1 https://www.bleepingcomputer.com/news/security/researcher-hacks-over-35-tech-firms-in-novel-supply-chain-attack/

2 https://www.websecuritylens.org/how-dependency-confusion-attack-works-and-how-to-prevent-it/

3 https://en.wikipedia.org/wiki/Vulnerability_database