Your applications have vulnerabilities it? Using third-party relies need to be cautious

introduction

Open source has far-reaching significance for the development of software that can say that it helps us to share the results, re-use software libraries developed by others, allowing us to focus on our own innovation, which promoted the rapid development of technology. According to incomplete statistics, 78 percent of enterprises are using open source, but there are many companies concerned about the security of third-party reliance park opened it? Of which only 13% of safety as the first consideration. The good news is there are still 50% of enterprises will be listed as the second or third security considerations, more and more companies starting to focus on the safety of third-party dependencies.

Why shut the security of third-party dependencies

Imagine Software Application we deliver a cake, our own development accounted for only a small part of the code, as shown below:

Open source is not tantamount to rely on safe, of course, does not mean unsafe, since 2000, only a few manufacturers contributions to open source, including Apache, Linux, IBM, OpenSSL etc., to 2015, anyone in contribution to the open source community, following figure is a mainstream software development library, a huge number

And when we use these dependencies, you must be aware of:

Open source is often dependent rarely tested for safety
Open source software developers generally not high on safety awareness
Open source software provider is no extra budget for safety testing
The main target for hackers is open source, because a large attack, affected area

Let's look at survey data sets rely on third-party security together:

How to manage third-party security dependence

We see that the third party is dependent on the presence of a very large security risk, then we should do it? Do not use third-party reliance is clearly unrealistic, we summarize the four steps

You have to know what the use of dependence
You do not need to delete dependence
Find and fix the currently known vulnerabilities
Continuously monitors newly discovered vulnerabilities, repeat the first three steps

Dependency analysis

Relatively simple, we use the current dependency management tool can easily do, such as the maven dependency tree

Delete unneeded dependence

We find it in time for developers to maintain dependence, even if the dependent no longer applies, but does not remove, which obviously will expand the scope of hacker attack, so we need to check periodically remove unneeded dependence

Find and fix bugs

第三步开始较为复杂，所幸已有很多开源组织提供了免费的漏洞库，如US-CERT，NVD，OSVDB等漏洞广播源，该类组织集中维护发现的已知漏洞，对外提供表述漏洞数据描述以及漏洞广播，为开源社区安全提供数据支持，有了漏洞数据源之后，判断我们的依赖中是否有依赖就简单了，我们仅需要根据我们的依赖包与漏洞数据库进行对比，就可以发现我们发布的应用中是否包含已知的漏洞，甚至有些开源组织会在漏洞库的基础上提供关于漏洞的修复建议，如 Synk.io，JFrog 和 Sync 合作贡献了一个漏洞数据源（JXray），其中包含主流漏洞数据源，包括刚才提到的几个，这样我们就可以对我们包含对漏洞进行漏洞升级。