The highest 10 open supply dangers
OWASP
1: Identified vulnerabilities
This part covers OSS elements with recognized vulnerabilities akin to software program flaws, usually inadvertently launched by software program builders and maintainers after which subsequently disclosed publicly, usually by security researchers in the neighborhood.
These vulnerabilities could also be exploitable relying on the context by which they’re used inside a corporation and utility. Whereas this level could seem trivial, it isn’t — failing to supply builders with this context results in vital toil, wasted time, frustration and infrequently resentment in direction of Safety.
There are efforts to handle this problem, such because the CISA Identified Exploited Vulnerability (KEV) catalog and Exploit Prediction Scoring System (EPSS).
Organizations can take actions to mitigate the chance of OSS elements with recognized vulnerabilities akin to scanning for vulnerabilities in all OSS elements they use, prioritizing findings based mostly on strategies akin to recognized exploitation, exploitation likelihood, reachability evaluation (which might cut back as much as 80% of noisy findings), and extra.
2: Compromise of a professional bundle
Subsequent up on the record of High 10 OSS Dangers is the compromise of a professional bundle. Malicious actors understand the worth of compromising a professional bundle to impression downstream customers, each organizationally and individually.
There are a number of strategies they’ll use to pursue this assault vector, akin to hijacking the accounts of the challenge maintainers or vulnerabilities within the bundle repositories.
