BURLINGTON, Mass.--(BUSINESS WIRE)--The world’s appetite for open source software is voracious.
In the last year, businesses around the globe significantly increased their use of open source and although they readily acknowledge growing concerns about open source-related security and operational risks, the effective management of open source is not keeping pace with the increase in use.
Those are among the key takeaways from the 2017 Open Source 360° Survey results released today by Black Duck’s Center for Open Source Research and Innovation (COSRI). The COSRI survey comprised 819 respondents primarily from the U.S. and EMEA, 74% of whom were software developers, IT operations/professionals, systems architects, development managers, and security professionals.
Nearly 60% of respondents said their organizations’ use of open source increased in the last year citing: cost savings, easy access, and no vendor lock-in (84%); ability to customize code and fix defects directly (67%); better features and technical capabilities (55%); and the rate of open source evolution and innovation (55%).
Additionally, in terms of open source’s positive impact on business, survey respondents highlighted accelerated innovation (55%) and quality improvement (44%).
Even as their organizations are embracing open source to accelerate application development and increase development agility, respondents expressed concern about license risk/loss of intellectual property (66%); exposure to internal applications to exploitation from open source vulnerabilities (64%); exposure of external applications to exploitation because of open source vulnerabilities (71%); unknown quality of components (74%); and failure of development teams to adhere to internal policies (61%).
Despite those high levels of concern, nearly half of survey respondents indicated their organizations have no formal policies for selecting and approving open source. And just 15% indicated they have automated processes in place to manage their open source use.
Respondents gave their organizations decidedly middling marks in areas of managing and securing their open source, with slightly more than half reporting: being in compliance with associated licenses (54%); being aware of known security vulnerabilities (55%); knowing where and which open source versions are currently integrated and deployed (54%); and conforming to internal policies (44%).
“The 2017 Open Source 360° survey responses correspond closely with our experience as we engage with businesses of all sizes in all industries around the world. Companies are using a tremendous amount of open source for sound economic and productivity reasons, but today most companies are not effective in securing and managing it,” said Black Duck CEO Lou Shipley. “This is surprising for a number of reasons. Today open source comprises 80% to 90% of the code in a modern application and the application layer is a primary target for hackers. This means that exploitation from known open source vulnerabilities represents the most significant application security risk most organizations face,” Shipley said.
The Open Source 360° survey results show that open source vulnerability tracking and remediation remain primarily manual processes carried out by internal resources (53%). Only 27% of respondents reported automatic identification and remediation tracking of known open source vulnerabilities.
Shipley noted that the survey responses are “also very much in line with results in the open source audits we conduct for our customers.”
Black Duck’s On-Demand business unit conducts hundreds of open source code audits annually, primarily related to merger and acquisition transactions. The recently published Open Source Security and Risk Analysis (OSSRA) report on 1,071 applications audited during 2016 found both high levels of open source usage – 96% of the applications contained open source – and significant risk to open source security vulnerabilities – more than 60% of the applications contained open source security vulnerabilities.
Notably, in that Open Source Security and Risk Analysis (OSSRA) report, audited applications from the financial industry contained 52 open source vulnerabilities per application, and 60% of the applications contained high-risk vulnerabilities. The retail and e-commerce industry had the highest proportion of applications with high-risk open source vulnerabilities, with 83% of audited applications containing high-risk vulnerabilities.
This year’s Open Source 360° Survey conducted by Black Duck’s COSRI is the successor to the former Future of Open Source Survey, co-presented for many years by Black Duck and North Bridge.
A detailed presentation of the complete Open Source 360° Survey results will be available on the Black Duck website on June 22 following a COSRI webinar discussion of the survey findings.
Other notable findings from the 2017 Open Source 360° survey include:
Methods for tracking use of open source: Information provided by developers (54%); Manual design/code reviews (36%); Scans to inventory open source in use (33%)
Methods for reviewing code for open source use: Don’t review code for open source (38%); Internal tools to scan for open source (27%); Third-party tools to scan for open source (28%)
Most important elements to a successful open source policy: A structured process for review and approval of open source use requests (42%); A whitelist/blacklist of approved open source components, specific to use cases 39%; A whitelist/blacklist of approved open source licenses, specific to use cases (39%)
Prevalent areas for open source usage: Build applications used within our organization (77%); Build applications used by our customers 69%; Build and run our IT operations infrastructure (69%)
Prevalent technology areas for open source use: Development Tools/Software Development Lifecycle (57%); Containers/DevOps/Virtualization/Cloud Computing (53%); Systems Management/Operating Systems (52%);
Open Source Contribution: (66%) of companies surveyed contribute to open source projects.
Open Source 360° 2017 collaborators included the following (platinum collaborators are in bold): Appnovation, Bareos GmbH & Co. KG, Black Duck Software, Capital One, Couchbase, Credativ, EnterpriseDB, Grid Protection Alliance, InfoSys, Open Hub, Open Invention Network (OIN), Open-Xchange, Opmantek, OSSAT (Open Source Academy of Arts, Science and Technology) of Pakistan, Pentaho, Red Hat, Rift-io, Rocket.Chat, Symphony Foundation, univention, WIPRO, WP Engine
About Black Duck
Organizations worldwide use Black Duck’s industry-leading products to automate the process of securing and managing open source software, eliminating the pain related to security vulnerabilities, compliance and operational risk. Black Duck is headquartered in Burlington, MA, and has offices in San Jose, CA, Vancouver, London, Belfast, Northern Ireland, Frankfurt, Hong Kong, Tokyo, Seoul and Beijing. For more information, visit www.blackducksoftware.com.
