Synopsys Study Highlights Core Challenges with Managing Open Source Risk in Software Supply Chains

By : Nata Kesuma | Thursday, April 14 2022 - 22:36 IWST

Synopsys, Inc. (Nasdaq: SNPS)
Synopsys, Inc. (Nasdaq: SNPS)

INDUSTRY.co.id - SINGAPORE – Synopsys, Inc. (Nasdaq: SNPS) today released the 2022 Open Source Security and Risk Analysis (OSSRA) report.

The report, produced by the Synopsys Cybersecurity Research Center (CyRC), examines the results of more than 2,400 audits of commercial and proprietary codebases from merger and acquisition transactions, performed by the Black Duck® Audit Services team.

The report highlights trends in open source usage within commercial and proprietary applications and provides insights to help developers better understand the interconnected software ecosystem. It also details the pervasive risks posed by unmanaged open source, including security vulnerabilities, outdated or abandoned components, and license compliance issues.

The 2022 OSSRA report findings underscore the fact that open source is used everywhere, in every industry, and is the foundation of every application built today. 

Outdated open source remains the norm - including presence of vulnerable Log4j versions. From an operational risk/maintenance perspective, 85% of the 2,097 codebases contained open source that was more than four years out-of-date. 88% utilized components that were not the latest available version. 5% contained a vulnerable version of Log4j.

Assessed codebases show open source vulnerabilities are decreasing overall. 2,097 of the assessed codebases included security and operational risk assessments. There was a more dramatic decrease in the number of codebases containing high-risk open source vulnerabilities. 49% of this year’s audited codebases contained at least one high-risk vulnerability, compared to 60% last year. Additionally, 81% of the assessed codebases contained at least one known open source vulnerability, a minimal decrease of 3% from the findings of the 2021 OSSRA.

License conflicts are also decreasing overall. Over half - 53% - of the codebases contained license conflicts, a substantial decrease from the 65% seen in 2020. In general, specific license conflicts decreased across the board between 2020 and 2021. 

20% of assessed codebases contained open source with no license or with a customized license. Since a software license governs the right to use it, software with no license presents the dilemma of whether use of the open source component entails legal risk. Additionally, customized open source licenses might place undesirable requirements on the licensee and will often require legal evaluation for possible IP issues or other implications.

“Users of SCA software have focused their attention on reducing open source license issues and addressing high-risk vulnerabilities, and that effort is reflected in the decreases we saw this year in license conflicts and high-risk vulnerabilities, said Tim Mackey, principal security strategist with the Synopsys Cybersecurity Research Center.

“The fact remains that over half of the codebases we audited still contained license conflicts and nearly half still contained high-risk vulnerabilities. Even more troubling was that 88% of the codebases [with risk assessments] contained outdated versions of open source components with an available update or patch that was not applied.”

“There are justifiable reasons for not keeping software completely up-to-date,” Mackey continued. “But, unless an organization keeps an accurate and up-to-date inventory of the open source used in their code, an outdated component can be forgotten until it becomes vulnerable to a high-risk exploit, and then the scramble to identify where it’s being used and to update it is on. This is precisely what occurred with Log4j, and why software supply chains and Software Bill of Materials (SBOM) are such hot topics.”

News Comment

Today's Industry

Collaboration and innovation is a common thread of various Business Twenty (B20) forums as an important part of G20 activities in 2022. (Foto: Liputan6.com)

Selasa, 21 Juni 2022 - 17:53 WIB

Inter Sectors Collaboration in Strengthening SMEs, Key for Post-Pandemic Recovery Acceleration

Indonesia owns an important role to support the world’s policy that prioritize various parties collaborations as the key to realize an inclusive world economy, included Small Middle Enterprises…

Collaboration and innovation is a common thread of various Business Twenty (B20) forums as an important part of G20 activities in 2022. (Foto: Liputan6.com)

Senin, 06 Juni 2022 - 21:35 WIB

Collaboration and Innovation, Key to support Inclusive Economy Growth

Collaboration and innovation is a common thread of various Business Twenty (B20) forums. This is an important part of G20 activities in 2022. That matters are also going to become a main key…

NORD-DuoDrive.jpg: The innovative and patented DuoDrive geared motor reaches outstanding system efficiency Image: NORD DRIVESYSTEMS

Selasa, 17 Mei 2022 - 14:00 WIB

NORD DRIVESYSTEMS at LogiMAT in Stuttgart From 31st May to 2nd June 2022 NORD will present innovative drive solutions for intralogistics

The specialist LogiMAT exhibition in Stuttgart offers as comprehensive overview of the intralogistics and process management market. As one of the market leaders for drive technology, NORD presents…

President Jokowi attends the meeting between ASEAN leaders and American entrepreneurs at Intercontinental the Willard Hotel, Washington DC, Thursday (05/12). Photo by: Laily Rachev

Selasa, 17 Mei 2022 - 13:00 WIB

President Jokowi Invites US CEOs to Boost Cooperation with Indonesia

President Joko “Jokowi” Widodo has invited company CEOs in the United States to boost cooperation with ASEAN countries, particularly Indonesia.

President Jokowi, President Biden, and ASEAN Leaders on a group photo prior to the dinner, at the White House, Washington D.C., Thursday (05/12)

Selasa, 17 Mei 2022 - 12:28 WIB

President Jokowi, ASEAN Leaders Attend Dinner Hosted by US President

President Joko “Jokowi” Widodo Thursday (05/12) attended a dinner with the leaders of ASEAN countries hosted by President of the United States Joe Biden at the White House, Washington D.C.