1

The title sounds like a trolling question but it is not (I'm a huge fan of OSS).

I have a small company with a web app that is undergoing infosec review with a Fortune 100 company. The questions I have been asked include:

  • How do you track and monitor vulnerabilities in open source software?
  • What steps do you take to ensure that the open source software is risk free? (This seems to be a very poorly worded question)

My current answer is that I don't do anything other than to only use established and reputable OSS, but I don't think that is enough.

It isn't feasible to review the code of all the OSS I am using. What would be a reasonable process to satisfy an infosec team?

The OSS to be evaluated is all Python (e.g., Flask, Flask-Security). I use VMs provided by Google/AWS (which they update), and I add some additional Python packages to them, and it is these additional Python packages that are my primary concern.

(They don't seem to want me to address all the OSS on the underlying Linux VM and I don't want to open that can of worms.)

Improve this question
1
  • 1
    There is no such thing as "risk free", no matter the development model or whether the final source code is available or not.
    – user
    Commented Jul 4, 2019 at 13:29

2 Answers 2

Reset to default
2

How do you track and monitor vulnerabilities in open source software?

The same way it's monitored in closed source software. Vulnerabilities are reported and updated in subsequent releases. Generally this cycle is even faster with OSS.

What steps do you take to ensure that the open source software is risk free?

The same steps that are taken with closed source software: review, reputation, support. History demonstrates that closed source and open source have statistically similar risks.

To be fair closed source provides a target for legal action, but unless you have deep pockets that's not a winner.

This may or may not help your argument:

GSA Open Source Policy

18F: An Open Source Team

18F, a digital services delivery team within the General Services Administration, develops in-house digital solutions to help agencies meet the needs of the people and businesses they serve. This requires flexibility in how we code, with a focus on lowering costs for the American people, while improving their interactions with the U.S. Government.

The default position of 18F when developing new projects is to:

  • Use Free and Open Source Software (FOSS), which is software that does not charge users a purchase or licensing fee for modifying or redistributing the source code, in our projects and contribute back to the open source community.
  • Develop our work in the open.
  • Publish publicly all source code created or modified by 18F, whether developed in-house by government staff or through contracts negotiated by 18F.

Benefits

  1. Flexible usage.
  2. Community involvement.
  3. Cost-savings.
  4. Reusability.
Improve this answer
1

Focus on the first question:

How do you track and monitor vulnerabilities in open source software?

Things you can (and should do):

  • Use distributions repositories. Major distributions such as Debian, Ubuntu, RHEL, etc. are quite good at patching in a timely manner. Staying up to date with these solves many issues.
  • Monitor relevant security related mailing lists or sites for potential problems. Some times a simple work around for a security problem may be published before a patch, and being aware of vulnerabilities may also reduce impact if hit by an attack.
  • Have defined deadlines for different attacks. Local user attack? Maybe 5 days is enough. Remote code execution? One day is probably enough and yet way to much...

For the second

What steps do you take to ensure that the open source software is risk free?

I would include some general blabla about best practice configuration, security vetting of install source.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .