When first learning to code many people start with a rudimentary “Hello World” program. Building the program teaches developers the basics of a language as they write the code required to display “Hello World” on a screen. As developers get more skilled, the complexity of the programs they build increases.
But building a complex app entirely from scratch these days is not the norm because there are so many fantastic services and functions available to developers via libraries, plug-ins, and APIs that developers can consume as part of their solution. If you were building a website to show off your amazing nail art or community farm you wouldn’t build your own mapping tool for directions, you’d plug in a map tool service like Bing Maps. And if another developer has already built out a robust, well-vetted open-source cryptographic library, you’re better off using that rather than trying to roll your own.
Today’s apps are rich composites of components and services—many of which are open source. Just how many? Well, the Synopsis 2020 Open Source Security and Risk Analysis Report found that “open source components and libraries are the foundation of literally every application in every industry.” But just like any other software, open-source components must be assessed and managed to ensure that the final product is secure. So how can you take advantage of the benefits of open source without increasing risk? Software Composition Analysis (SCA)!
SCA is a lifecycle management approach to tracking and governing the open source components in use in an organization. SCA provides insight into which components are being used, where they are being used, and if there are any security concerns or updates required. This approach provides the following benefits:
A strong SCA program starts with a vision. If you document your strategy, developers and managers alike will understand your organization’s approach to open source. This will guide decision-making during open-source selection and contribution. Consider the following:
Your strategy will help you align on objectives and guidelines, but to put it in action, you’ll need to define processes and responsibilities.
To manage your open source software, you need to track the components and open-source licenses that are currently in use. It’s also important to scan software for vulnerabilities. Open source and commercial tools are available and can be integrated into your continuous integration/continuous deployment process.
Microsoft Application Inspector is a static analysis tool that you can use to detect poor programming practices and other interesting characteristics in the code. It can help you identify unexpected features that require additional scrutiny.
Building consensus for the open-source security program is just as important as the program components. Make sure all your resources, approved open source licenses, and processes are easily accessible. When you roll out the program, clearly communicate why it’s important. Train your developers in the process and the tools they will use and provide regular updates as things change.
Open Source is a vibrant and valuable part of the development process. With the right program and tools in place, it can also be a well-governed and risk-managed process that helps developers deliver more secure software faster.
Read Microsoft’s guidance for managing third part components.
Find advice for selecting and gaining approval for open source in your organization.
Bookmark the Security blog to keep up with our expert coverage on security matters. Also, follow us at @MSFTSecurity for the latest news and updates on cybersecurity. Or reach out to me on LinkedIn or Twitter.
The main components of the Microsoft Intune Suite are now generally available. Read about how consolidated endpoint management adds value and functionality for security teams.
To confidently secure identity and access at your organization, here are five areas Microsoft recommends prioritizing in the new year.
The Microsoft Incident Response team takes swift action to help contain a ransomware attack and regain positive administrative control of the customer environment.
With the coming wave of AI, this is precisely the time for organizations to prepare for the future. To be properly ready for AI, Zero Trust principles take on new meaning and scope. The right endpoint management strategy can help provide the broadest signal possible and make your organization more secure and productive for years to come.
