http://www.linux-watch.com/news/NS5622797384.html 

By Steven J. Vaughan-Nichols
Linux Watch
March 25, 2008

Palamida, an open-source risk management company, believes in open 
source. But at the same time, its corporate code audits of more than 500 
million lines of code has found time and again "specific open-source 
projects inside mission critical systems that had not been patched" with 
most recent updates.

Part of the problem? Many companies are unclear both about what programs 
they're using, never mind when and how to update them.

As Palamida pointed out in a statement shared with Linux-Watch, "nine 
out of 10 open-source projects do not have commercial services behind 
them (such as Red Hat, Novell, etc.) that can push the updates as they 
appear." Besides that, even companies that do a good job of tracking 
their open-source software can miss things. Palamida gave an example of 
one company, which thought it was doing a good job, but it turned out 
that instead of using 300 open-source projects, they were actually using 
835 programs.

The point? Even if you are using an open-source program, like the 
popular data compression library zlib which does a good job of patching 
problems, but you don't know that you're using zlib, how are you going 
to keep it up to date? Well, clearly, you're not.

In the case of some of these programs, you may not actually have a 
problem. For example, if you're running Linux from a major distributor 
such as Ubuntu, you don't need to worry much about keeping OpenSSH, the 
secure shell remote control program, current. Ubuntu will do that for 
you.

On the other hand, Palamida pointed out that you may be using other 
open-source programs, such as Apache Geronimo, the open-source Java 
Enterprise Edition server, the BusyBox embedded tool kit or Freetype, a 
font-rendering engine, and you may be missing their updates.

So what do you do? According to Theresa Bui-Friday, co-founder of 
Palamida, in an e-mail interview, education comes first, "coupled with 
an in-house policy that is easy to understand and enforce. While many 
companies do a good job of tracking some of their open source through 
various means (from spreadsheets to e-mails), these methods aren't able 
to capture the breadth and scope of actual open-source use. Thus, 
undocumented code is left in the code base which leaves the organization 
open to vulnerabilities. If you don't know what you have, you don't know 
if it needs patching and can't effectively mitigate app sec risks."

Next, businesses should "implement an automated solution to regularly 
audit code." Palamida has several programs that can help with this.

These are IP Amplifier, which is a code-auditing tool and IP Authorizer, 
which helps ISVs (independent software vendors) make sure they're using 
approved code with the right licenses.

For ISVs, "We recommend at each build as the software dev process is so 
dynamic and fluid. Additionally, once a process has been put into place, 
we recommend that companies adopt a means for developers to register 
their open-source code use by receiving approval to use a specific 
project, say, Zlib, and then downloading the 'gold version' of that 
project, the most stable, up-to-date version, and adding it to what 
we've termed the 'Golden Vault' of open source. These would be the 
approved projects, in their most stable form, collected in a database 
wherein all of your developers can quickly and easily go to retrieve 
what they need without trolling the Web for a version that might be 
vulnerable and might not be on the approved use list," explained 
Bui-Friday.

If a company is an ISV and facing an emergency, "such as product going 
to market and a serious flaw may have been found last minute, or an 
acquisition or a data breach has occurred and you're trying to find out 
why," Bui-Friday said "bringing in professionals is the quickest and 
easiest way to perform a thorough code audit. Due to their high level of 
expertise and knowledge of the audit process, the professional services 
arm of our organization can do an audit in three weeks that may take a 
company three months to handle on [its] own."

"Ideally, though," Bui-Friday continued, "organizations will be equipped 
to handle audits and we recommend that they start with the applications 
that mean the most to them, i.e., the areas that cause the most 
financial, security and business strain if it's not handled. You do not 
need to audit everything all at once. You need to prioritize based on 
business need. It's important to have a policy in place that outlines 
regular and complete code audits."

When all is said and done, Bui-Friday said, "We want organizations to be 
able to do away with incomplete manual processes and protect themselves 
against app security risks."

While obviously Palamida has its own business interest here, the points 
the company makes are excellent ones. A company needs to track its 
open-source programs, both for its own sake and for the sake of its 
customers. Otherwise it will eventually face a serious operations 
problem without even being able to understand exactly where the 
underlying software problem lies.


___________________________________________________      
Subscribe to InfoSec News
http://www.infosecnews.org/mailman/listinfo/isn