Snyk and Linux Foundation Study Finds Widespread Open Source Use Leaves Security Gaps

Developer security company Snyk and The Linux Foundation, the global nonprofit that supports innovation through open source, have published their first joint research report, The State of Open Source Security. It sets out how the heavy reliance on open-source software in modern application development creates serious security risk, and how poorly equipped many organisations are to manage it.

The headline findings are three:

• 41% of organisations, more than four in ten, lack high confidence in the security of their open-source software.
• A typical application development project carries 49 vulnerabilities and 80 direct dependencies, meaning open source code that the project calls.
• Fixing vulnerabilities in open-source projects is taking steadily longer. The average went from 49 days in 2018 to 110 days in 2021, more than double.

Matt Jarvis, director of developer relations at Snyk, compared today's developers to manufacturers with supply chains of their own. Where a carmaker assembles parts, he said, developers assemble code, stitching existing open-source components together with what they write themselves. That raises productivity and speeds up innovation, in his view, but it has also produced real security worries. Jarvis said the report turned up broad evidence of "industry naivete" about the current state of open-source security, and that Snyk and The Linux Foundation intend to use the results to teach and equip developers worldwide so they can keep working quickly without giving up security.

Brian Behlendorf, general manager of the Open Source Security Foundation (OpenSSF), agreed that open source makes developers more efficient and drives innovation faster. The way modern applications are put together, though, makes them harder to secure. He said the research leaves no doubt that the risk is genuine, and that the industry has to cooperate even more closely to leave weak open source and software supply chain security practices behind.

Policies and ownership are often missing

Development teams now pull code from many sources. They reuse what they wrote for earlier applications and search repositories for open-source components that do what they need. According to the report, working this way calls for a different approach to developer security, and many organisations have yet to make that shift.

Fewer than half of organisations (49%) have a security policy covering how open-source software is developed or used. Among medium-to-large companies, the share falls to just 27%. And 30% of organisations with no such policy admit openly that nobody on their team is directly responsible for open-source security at present.

Dependencies of dependencies

Once developers build an open-source component into an application, the application depends on it and inherits any vulnerability it contains. The report shows this is no theoretical danger: every application it assessed had dozens of vulnerabilities spread over many direct dependencies.

Indirect or transitive dependencies, the components that a project's own dependencies rely on, add to the problem. Many developers are not even aware these exist, which makes them harder still to follow and protect. Respondents do grasp some of this complexity. More than a quarter said they worry about the security impact of their direct dependencies, yet only 18% felt confident in the controls they have over transitive ones. Forty percent of all vulnerabilities found sat in transitive dependencies.

Slower fixes in open-source projects

As application development has become more complicated, so have the security problems development teams must handle. Open source makes building software more efficient, but it adds to the work of remediation. The report found that vulnerabilities in open-source projects take almost 20% longer to fix (18.75%) than those in proprietary projects.