Is open source really a security concern?

Open source code can inject dozens of threats into mobile and web applications, according to a new study by Veracode. But open source proponents say consider the source -- in both senses of the word.

The application security provider released an analysis of 5,000 enterprise applications uploaded to its platform that showed open source components could open up gaping security holes. Veracode gathered data over the last two months using its newly released software composition analysis service. The data, it said, showed that open source and third-party components introduce an average of 24 known vulnerabilities into each web application.

The common use of reusable, pre-fabricated software components from open source developers for IT systems, the company said, could leave large openings in security that increase the risk of data breaches, malware injections and denial-of-service attacks. It quoted other studies that said 95 percent of all IT organizations will leverage some open source element in mission-critical solutions by 2015, including critical infrastructure systems used by financial institutions.

"Most third-party and open source components do not undergo the same level of security scrutiny as custom-developed software," Veracode warned.

Open source advocates, however, said the scenario isn't nearly as scary as the company makes out.

Knowing where the vulnerabilities lie is a key part of securing them, said Josh King, chief technologist at New America Foundation's Open Technology Institute.

"If you want to be cynical about it," King said, Veracode's report could be seen as selling its own services. But more importantly, he stressed, is that the ability to find the security holes is actually a key benefit of open source.

King said open source software is centered on a group approach to finding and securing security flaws. The approach can be more effective than closed source development, as more eyes are on the code. King noted that vulnerabilities in single source code are knowable only to the maker, and only if that maker has vetted the code completely.

"While we can identify and report on the issues in software where the source code is publicly available," he said, "there are an unknown number of unidentified issues in closed source software that may remain unaddressed."

The increasing ubiquity of open source, King said, also suggests something of a market verdict. If 95 percent of IT projects will use open source by 2015, he added, "it must be extremely useful code."

Bottom line, King said, both closed source and open source code are useful. Federal IT managers should know as much as they can about what they're using.