Social Security Administration’s Post

The following article highlights news relating to the increasing presence of nefarious actors planting malicious code in open-source projects. The presence of this pattern has begun to tear the once trusting communities that create the free to use software. Further, the rate at which these occurrences are happening in the sphere of open-source is more prominent than in corporate and private/solitary environments because of the trusting nature these communities have harbored to this point.  #LetsBeCarefulOutThere#flcc270 https://lnkd.in/gSgKeNBw

OSS Using #open #source #software is like a double-edged sword. if you look from angle of cost reduction it may effect in short and medium only but this will depend on the human resources qualifications in organization. but if you look from risk and information security point of view it will be different for a lot of Reasons From risk side : 1. Unknown vulnerabilities: since open source code available for all "including hackers" hackers can study the code and can find more critical vulnerabilities. and use it for attack, this kind of risk will be high risk and with high likelihood. 2.Uncertain long-term sustainability : The group or persons which provide those software, stop support .this kind of risk will be high risk and will impact the improvement of the application but with very low of likelihood. 3.#Regulatory and licensing risks Despite being open-source, every open-source application and package comes with its own usage license. Risks arise if the license turns out to be incompatible with using the application for the intended purpose, or the licenses of some application components are incompatible with each other. It’s also possible for one or more dependency components to violate applicable laws or regulatory requirements imposed on the #company. 4. Immature software Using components developed by a team that lacks maturity entails a number of inconveniences and risks. The problems associated with immature software range from insufficient or inaccurate code documentation to instability and error-prone operation and the absence of a set of tests for regression testing. #RISKMANAGEMENT #RISK #AUDIT #RISKANALYSIS #auditmanager #OSS #Informationsecurity #itmanagement #compliancemanagement #IT #AymanElnali

It's not likely you're going to stop using open-source software any time soon, but what about the inherent risks of OSS? Well, knowledge is power. Check out the top 5 risks and learn strategies to tackle them in this blog. #opensourcesecurity #opensourcesoftware #supplychainsecurity

The worst thing you can do in your Open Source Security strategy Bringing others down to prove you're the best. I see this in open-source software management all the time. Example: 1. Criticizing traditional software for its restricted access. 2. Underestimating the risks of open-source software. 3. Ignoring the importance of assessing and securing open-source software. Recognize the mistakes? This is called Open-Source Elitism. And it's wrong. If anything, it makes your security strategy weaker. You don't need to bring a method down to prove yours is better. Simply show why open-source is good. Stop fighting to beat others ↳ Start fighting to beat the odds in your favor There's a life lesson in here too. ❓ How are you ensuring the security of your open-source software in your enterprise environment? 🌐Reach out to us: ✅ WhatsApp: +91 9810609560 ✅ Email: ajai@sevenstepconsulting.com ✅ Web: sevenstepconsulting.com #OpenSource #Security #EnterpriseSoftware

"Log4j created awareness that you should have as much security testing automation in build processes as possible. It was also a wake-up call to how security technical debt, when left unaddressed, can cause urgent issues to take an enormous amount of time to fix.”, shares Veracode CTO and Founder, Chris Wysopal. #supplychainsecurity #opensourcesecurity #opensourcesoftware

#goodreads Firms mostly rely on open-source software (OSS), using third-party and open-source libraries and components. These apps boost the speed and lower development costs. Read full: https://itsw.in/47lD1WC #SecurityRisk #securitysolutions #riskmanagement #CIOs

❓ Controversial Opinion❓ The future of secure software does not lie in finding skilled application security specialists. I need your 🆘 help 🆘 Can you help generate an open-source, anonymous picture of how much security support we have compared to the size of our software teams? https://lnkd.in/gcnb2dAE The results of my research into application security resourcing are interesting, so I'd like to share an interim snapshot. Even our largest organizations have startlingly low ratios of security expertise to developer population size. I am still looking for many more submissions from all sizes and types of organizations, and I am committed to open-sourcing the anonymous results. If you can spare 3 minutes, you can help me clearly understand how appsec works in our organizations worldwide. Please share this, comment, repost, and share in your groups. The link to the survey is in the first comment.

As someone who was into high tech before it was called that, i find today’s landscape is fraught with wrong decisions and overreaching of people who are “IT” consultants. First of all, computers are tools that need to be calibrated for use so the actual business applications that use those tools work properly. This is all about technical infrastructure and of course, security. Business (includes any software that sits on top of the tools) applications are best understood by those who use it in their every day endeavors, not necessarily IT professionals who don’t really use the applications. Know the difference. Applications “experts” are not IT professionals and vice versa. As a manger or user, you need both and should make your decisions based on which category fits the situation.

OECD Forum Open Source Security Panel Discussion at July 10, 2024: It was a great opportunity to discuss open source security and security-by-design. 1. Unlike enterprise software development, integrating security into open-source projects requires security testing after development or before use. 2. A standard way of naming open-source projects is necessary to identify repositories and CVE vulnerabilities. 3. Dependency analysis is crucial for vulnerability management (for example, JavaScript projects have an average of 683 transitive dependencies). 4. A cost-effective approach to open-source security is needed (e.g., applying SBOM can reuse the existing results of verifying sub components, which may reduce the cost for downstream projects). The discussion was exiting and the support of OECD countries will be beneficial for many aspects by securing open source projects.

📦 The high proportion of flaws in EMEA applications is closely tied to the extensive use of open-source code in Java applications. 💡 As Java apps heavily rely on third-party code, it's essential for organizations in EMEA to manage and secure their software supply chain effectively. To get more insights, download the EMEA Snapshot of State of Software Security, brought to you by Veracode. #softwaresecurity #appsec