Open Source

Is open source really a security concern?

Image from

Open source code can inject dozens of threats into mobile and web applications, according to a new study by Veracode. But open source proponents say consider the source -- in both senses of the word.

The application security provider released an analysis of 5,000 enterprise applications uploaded to its platform that showed open source components could open up gaping security holes. Veracode gathered data over the last two months using its newly released software composition analysis service. The data, it said, showed that open source and third-party components introduce an average of 24 known vulnerabilities into each web application.

The common use of reusable, pre-fabricated software components from open source developers for IT systems, the company said, could leave large openings in security that increase the risk of data breaches, malware injections and denial-of-service attacks. It quoted other studies that said 95 percent of all IT organizations will leverage some open source element in mission-critical solutions by 2015, including critical infrastructure systems used by financial institutions.

"Most third-party and open source components do not undergo the same level of security scrutiny as custom-developed software," Veracode warned.

Open source advocates, however, said the scenario isn't nearly as scary as the company makes out.

Knowing where the vulnerabilities lie is a key part of securing them, said Josh King, chief technologist at New America Foundation's Open Technology Institute.

"If you want to be cynical about it," King said, Veracode's report could be seen as selling its own services. But more importantly, he stressed, is that the ability to find the security holes is actually a key benefit of open source.

King said open source software is centered on a group approach to finding and securing security flaws. The approach can be more effective than closed source development, as more eyes are on the code. King noted that vulnerabilities in single source code are knowable only to the maker, and only if that maker has vetted the code completely.

"While we can identify and report on the issues in software where the source code is publicly available," he said, "there are an unknown number of unidentified issues in closed source software that may remain unaddressed."

The increasing ubiquity of open source, King said, also suggests something of a market verdict. If 95 percent of IT projects will use open source by 2015, he added, "it must be extremely useful code."

Bottom line, King said, both closed source and open source code are useful. Federal IT managers should know as much as they can about what they're using.

About the Author

Mark Rockwell is a senior staff writer at FCW, whose beat focuses on acquisition, the Department of Homeland Security and the Department of Energy.

Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, magazine and Wireless Week.

Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.

Click here for previous articles by Rockwell. Contact him at [email protected] or follow him on Twitter at @MRockwell4.


  • Workforce
    Avril Haines testifies SSCI Jan. 19, 2021

    Haines looks to restore IC workforce morale

    If confirmed, Avril Haines says that one of her top priorities as the Director of National Intelligence will be "institutional" issues, like renewing public trust in the intelligence community and improving workforce morale.

  • Defense
    laptop cloud concept (Andrey Suslov/

    Telework, BYOD and DEOS

    Telework made the idea of bringing your own device a top priority as the Defense Information Systems Agency begins transitioning to a permanent version of the commercial virtual remote environment.

Stay Connected