The title sounds like a trolling question but it is not (I'm a huge fan of OSS).
I have a small company with a web app that is undergoing infosec review with a Fortune 100 company. The questions I have been asked include:
- How do you track and monitor vulnerabilities in open source software?
- What steps do you take to ensure that the open source software is risk free? (This seems to be a very poorly worded question)
My current answer is that I don't do anything other than to only use established and reputable OSS, but I don't think that is enough.
It isn't feasible to review the code of all the OSS I am using. What would be a reasonable process to satisfy an infosec team?
The OSS to be evaluated is all Python (e.g., Flask, Flask-Security). I use VMs provided by Google/AWS (which they update), and I add some additional Python packages to them, and it is these additional Python packages that are my primary concern.
(They don't seem to want me to address all the OSS on the underlying Linux VM and I don't want to open that can of worms.)