Basis for "trusting" third party code and services

Question

I remember reading an article mentioning, that third party services and code should not be trusted, meaning blind trust.
So, i was thinking, everyone uses third party code in software development daily, even high profile IT security companies, and some of us take it for granted that the code they just used is trusted, meaning secure and tested.

Questions:

• What's the basis for trusting third party code and services in software development?
• What measures are taken by IT security companies before granting that trust?
• What measures are taken by IT security companies to maintain that trust?

Both open-source and closed-source.

For example, think of:

• The web hosting company to host your or your client's application and data

• The piece of software you didn't write but work with.

Thanks!

Answer 1

I was recently employed for an organization that used third party software. Here is our thought process.

• There is strength in numbers. Third party software that is A) open source, B) has a dedicated and knowledgeable security team, C) has a responsible disclosure policy, and D) is widely used by thousands of customers is better than anything our organization could ever put out.
• There is strength in doing the legwork. I was assigned to every module of this third party software, and I did a full review of it before allowing it to be added to our infrastructure. And if we found a vulnerability, we utilized the responsible disclosure program to make the software better.
• There is strength in updating. We subscribed to vendor alerts to make sure that if someone else found something, we were able to respond to the incident and protect our infrastructure.

Of course, there are also weaknesses to this approach:

• There is weakness in homogeneous software. If a large exploit came out, there's a high chance someone found our site and attempted a point and shoot exploit.
• There is weakness in numbers. We did a full review, but did the other thousands of people using it? Probably not.
• There is weakness in volunteer work. If something happened, there was no vendor rep to talk to. We had to A) retrace the problem, and B) fix it before we got hit.
• There is weakness in quality control. Open source is all about community contribution. However, the first law of humans is that humans are stupid, and no language is stupid proof. Especially PHP, which is what the software was written in.

As with all security policies, you must be risk aware, and minimize risk where you can. The only way to reduce your risk to zero is to write on wax tablets by candle-light.