Open Source

Is open source really a security concern?

Image from

Open source code can inject dozens of threats into mobile and web applications, according to a new study by Veracode. But open source proponents say consider the source -- in both senses of the word.

The application security provider released an analysis of 5,000 enterprise applications uploaded to its platform that showed open source components could open up gaping security holes. Veracode gathered data over the last two months using its newly released software composition analysis service. The data, it said, showed that open source and third-party components introduce an average of 24 known vulnerabilities into each web application.

The common use of reusable, pre-fabricated software components from open source developers for IT systems, the company said, could leave large openings in security that increase the risk of data breaches, malware injections and denial-of-service attacks. It quoted other studies that said 95 percent of all IT organizations will leverage some open source element in mission-critical solutions by 2015, including critical infrastructure systems used by financial institutions.

"Most third-party and open source components do not undergo the same level of security scrutiny as custom-developed software," Veracode warned.

Open source advocates, however, said the scenario isn't nearly as scary as the company makes out.

Knowing where the vulnerabilities lie is a key part of securing them, said Josh King, chief technologist at New America Foundation's Open Technology Institute.

"If you want to be cynical about it," King said, Veracode's report could be seen as selling its own services. But more importantly, he stressed, is that the ability to find the security holes is actually a key benefit of open source.

King said open source software is centered on a group approach to finding and securing security flaws. The approach can be more effective than closed source development, as more eyes are on the code. King noted that vulnerabilities in single source code are knowable only to the maker, and only if that maker has vetted the code completely.

"While we can identify and report on the issues in software where the source code is publicly available," he said, "there are an unknown number of unidentified issues in closed source software that may remain unaddressed."

The increasing ubiquity of open source, King said, also suggests something of a market verdict. If 95 percent of IT projects will use open source by 2015, he added, "it must be extremely useful code."

Bottom line, King said, both closed source and open source code are useful. Federal IT managers should know as much as they can about what they're using.

About the Author

Mark Rockwell is a senior staff writer at FCW, whose beat focuses on acquisition, the Department of Homeland Security and the Department of Energy.

Before joining FCW, Rockwell was Washington correspondent for Government Security News, where he covered all aspects of homeland security from IT to detection dogs and border security. Over the last 25 years in Washington as a reporter, editor and correspondent, he has covered an increasingly wide array of high-tech issues for publications like Communications Week, Internet Week, Fiber Optics News, magazine and Wireless Week.

Rockwell received a Jesse H. Neal Award for his work covering telecommunications issues, and is a graduate of James Madison University.

Click here for previous articles by Rockwell. Contact him at or follow him on Twitter at @MRockwell4.


  • Defense
    The U.S. Army Corps of Engineers and the National Geospatial-Intelligence Agency (NGA) reveal concept renderings for the Next NGA West (N2W) campus from the design-build team McCarthy HITT winning proposal. The entirety of the campus is anticipated to be operational in 2025.

    How NGA is tackling interoperability challenges

    Mark Munsell, the National Geospatial-Intelligence Agency’s CTO, talks about talent shortages and how the agency is working to get more unclassified data.

  • Veterans Affairs
    Veterans Affairs CIO Jim Gfrerer speaks at an Oct. 10 FCW event (Photo credit: Troy K. Schneider)

    VA's pivot to agile

    With 10 months on the job, Veterans Affairs CIO Jim Gfrerer is pushing his organization toward a culture of constant delivery.

Stay Connected


Sign up for our newsletter.

I agree to this site's Privacy Policy.