2

I remember reading an article mentioning, that third party services and code should not be trusted, meaning blind trust.
So, i was thinking, everyone uses third party code in software development daily, even high profile IT security companies, and some of us take it for granted that the code they just used is trusted, meaning secure and tested.

Questions:

  • What's the basis for trusting third party code and services in software development?
  • What measures are taken by IT security companies before granting that trust?
  • What measures are taken by IT security companies to maintain that trust?

Both open-source and closed-source.

For example, think of:

  • The web hosting company to host your or your client's application and data

  • The piece of software you didn't write but work with.

Thanks!

  • edited, does the question seems too broad?, if so what can i specify more. – HassenPy Dec 16 '15 at 15:46
3

I was recently employed for an organization that used third party software. Here is our thought process.

  • There is strength in numbers. Third party software that is A) open source, B) has a dedicated and knowledgeable security team, C) has a responsible disclosure policy, and D) is widely used by thousands of customers is better than anything our organization could ever put out.
  • There is strength in doing the legwork. I was assigned to every module of this third party software, and I did a full review of it before allowing it to be added to our infrastructure. And if we found a vulnerability, we utilized the responsible disclosure program to make the software better.
  • There is strength in updating. We subscribed to vendor alerts to make sure that if someone else found something, we were able to respond to the incident and protect our infrastructure.

Of course, there are also weaknesses to this approach:

  • There is weakness in homogeneous software. If a large exploit came out, there's a high chance someone found our site and attempted a point and shoot exploit.
  • There is weakness in numbers. We did a full review, but did the other thousands of people using it? Probably not.
  • There is weakness in volunteer work. If something happened, there was no vendor rep to talk to. We had to A) retrace the problem, and B) fix it before we got hit.
  • There is weakness in quality control. Open source is all about community contribution. However, the first law of humans is that humans are stupid, and no language is stupid proof. Especially PHP, which is what the software was written in.

As with all security policies, you must be risk aware, and minimize risk where you can. The only way to reduce your risk to zero is to write on wax tablets by candle-light.

  • have you dealt with 3rd party services, for example, web hosting companies, what makes you trust one to host your or your client's application and data. – HassenPy Dec 16 '15 at 16:14
  • 1
    I outlined that in bullet point 1. Other than that, research and a willingness to communicate. Security breaches will happen. How the vendor responds is the most important part. – Ohnana Dec 16 '15 at 16:21

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.