---
title: "Open Source Security Issues: Next on the Radar for General Counsels"
url: "https://thecybersecurityplace.com/open-source-security-issues-next-on-the-radar-for-general-counsels/"
date: "2015-10-29T00:47:09+00:00"
section: "Software"
tags:
  - "Software Security"
source: "shellshocker.net"
source_url: "https://shellshocker.net/"
---

# Open Source Security Issues: Next on the Radar for General Counsels

October 29, 2015 · Reported by shellshocker.net

> By Matthew H. Jacobs, Vice President and General Counsel, Black Duck Software, Inc.
>
> According to the Black Duck2015 Future of Open Source Survey, 78 percent of companies use significant amounts of open source software in their development – and that percentage is steadily rising. While license compliance continues to be top of mind for many lawyers, a related issue – the potential security implications of increased open source usage – is also now becoming clear. It’s critical for general counsels (GCs) to understand the importance of this emerging challenge, learn what it means for their companies’ bottom lines, and understand how they can help drive the conversation about open source security among their company’s senior leadership.
>
> Acknowledging the increasing role of open source, GCs play a critical role in helping their organizations deploy systems and methods for tracking and managing the open source code introduced into their organizations. Without a systematic process for identifying and tracking an organization’s open source use, it can be nearly impossible for an organization to know what open source it is using and where and how open source software is deployed in the code base. This lack of visibility hampers compliance with applicable open source licenses and, typically, an organization’s governance policies. Often, software development groups select and deploy open source components without proper legal and engineering vetting – which can cause important licensing obligations and code quality and security issues to be overlooked.
>
> Security: Hidden Vulnerabilities Could Mean Future Problems
>
> The National Vulnerability Database ( NVD ), the Open Sourced Vulnerability Database (OSVDB), and commercial vulnerability databases such as Risk Based Security’s VulnDB, together report some 4,000 vulnerabilities in open source code emerging each year. Yet according to the 2015 Future of Open Source Survey, 67 percent of companies fail to monitor open source code for security vulnerabilities. Clearly, open source code security issues represent looming future challenges for GCs and their partners in IT.
>
> Recent, well-publicized vulnerabilities such as Heartbleed and Shellshock provide a case in point. Heartbleed resulted from a set of bugs in the OpenSSL library used to negotiate secure communications between web servers and browsers. When Heartbleed emerged, more than 500,000 organizations across the globe were left pondering their degree of exposure. For companies lacking visibility into the open source components in their code bases, Heartbleed remediation was a logistical nightmare.
>
> Similarly, Shellshock, a flaw in the “bash” shell and interpreter (an integral part of Linux, Unix, and Apple’s Mac OS X operating system) presented a vulnerability that was exploitable by cybercriminals to facilitate remote execution of malicious code on websites and other outward-facing servers. Since many websites run the open source Apache server, which employs bash as part of standard CGI (common gateway interfaces), the threat was particularly serious and widespread.
>
> With both Heartbleed and Shellshock, the vulnerabilities lurked in systems for years before they were exposed – highlighting the need for ongoing visibility into the open source code in use in an organization’s code base. Worryingly, some observers argue that such exploits represent only the beginning of a coming onslaught of exploits.
>
> Crucial Issues for Corporate Counsels
>
> Given these realities, GCs should familiarize themselves with a number of important open source security related issues. Armed with this information, GCs will be better equipped to help their organizations avoid significant security as well as governance and compliance risks. These issues include:
>
> Conclusion: What GCs Can Do to Avert Legal Fallout from Open Source Security Issues
>
> The bottom line is that many of the breaches referenced above could easily be averted if companies know to upgrade to the remediated revision of affected open source components, or if they had known enough not to select component versions with known vulnerabilities in the first place. But all too often a lack of active management and insight into the selection, deployment, and ongoing management of open source components results in companies failing to deploy even the most basic and reasonable risk avoidance methods. As such, GCs need to engage with the rest of the senior leadership team to ensure these issues are addressed. They can, and should, play a crucial role in helping to guide the upper management discussion about software security issues – and their proactive contributions and ongoing participation in the process might just help their organizations avert costly and damaging legal difficulties.

[Read the full article at shellshocker.net](https://shellshocker.net/)

**Tags:** [Software Security](https://thecybersecurityplace.com/tag/software-security/)