Synopsys, a leader in the software development space, has released the eighth edition of its Open Source Security and Risk Analysis (OSSRA) report. Produced by the Synopsys Cybersecurity Research Center (CyRC), the 2023 OSSRA report examines the results of more than 1,700 audits of commercial and proprietary codebases involved in merger and acquisition transactions and highlights trends in open source usage across 17 industries.
The findings of the report deliver an in-depth look at the current state of open source security, compliance, licensing and code quality risks in commercial software with the goal of helping security, legal, risk and development teams better understand the open source security and license risk landscape. This year’s findings revealed an overwhelming majority of codebases (84%) contain at least one known open source vulnerability, a nearly 4% increase from last year.
The first step towards reducing business risk from open source, proprietary and commercial code involves a comprehensive inventory of all software a business uses, regardless of where it comes from or how it’s acquired. Only with this complete inventory – a Software Bill of Materials (SBOM) – can organisations establish a strategy to address risk stemming from new security disclosures like Log4Shell.
“The report findings underscore the reality of open source as the underlying foundation of most types of software built today,” said Jason Schmitt, General Manager of the Synopsys Software Integrity Group. “An increase in the average number of open source components further reinforces the importance of implementing a comprehensive SBOM that lists all open source components in your applications as well as their licenses, versions and patch status.”
Key findings include:
- A five-year overview of OSSRA data shows dramatic growth in open source use: The global pandemic contributed to the EdTech sector’s adoption of open source, which grew by 163%, with educational courses and instructor/student interactions increasingly pushed online.
- High-risk vulnerabilities over the past five years have also increased at an alarming rate: Since 2019, high risk vulnerabilities in the retail and e-commerce sector jumped by 557%. Comparatively, the IoT sector, with 89% of the total code being open source, saw a 130% increase in high-risk vulnerabilities in the same period.
- Use of open source components with no licenses puts organisations at greater risk of violating copyright law than those using licensed components: The report found that 31% of codebases are using open source with no discernible license or with customised licenses. This is a 55% increase from last year’s report. The lack of a license associated with open source code, or a variant of another open source license, may place undesirable requirements on the licensee and will often require legal evaluation for possible IP issues or other legal implications.
- Available code quality and security patches are not applied to a majority of codebases: Of the 1,480 audited codebases that included risk assessments, 91% contained outdated versions of open source components. Unless an organisation keeps an accurate and up-to-date SBOM, an outdated component can be forgotten until it becomes vulnerable to a high-risk exploit.
“The key to managing open source risk at the speed of modern development is maintaining complete visibility of application contents,” said Mike McGuire, Senior Software Solutions Manager, Synopsys Software Integrity Group. “By building this visibility into the application life cycle, businesses can arm themselves with the information needed to make informed, timely decisions regarding risk resolution.”
