You can also read and share this article in French, German and Spanish.

Cute Attacks With Acute Impact on Your Application Security Testing Effectiveness

Here we go again: Another attack with a cute name is about to make the news. More dangerous than a Ghost, a POODLE, a FREAK, a Heartbleed, a Shellshock or the other 6,000-plus attacks that show up each year, we know at least two things about it:

  1. It will probably attack through a vulnerable open source component.
  2. It is highly likely you’ll find the open source component in your apps.

Addressing the Open Source Challenge

Should you stop your developers from using open source? You can’t — at least if you want them to be productive. In fact, more and more software is reliant on open source components than ever before. The Forrester report titled “Secure Applications at the Speed of DevOps” states that “approximately 80 to 90 percent of the code in modern applications is from open source components.”

Clearly, open source is here to stay. To protect yourself, you must proactively test your code to assure that you don’t have vulnerable libraries. And since it’s extremely likely that your organization is vulnerable in some fashion, you should focus on two specific success factors.

Success Factor One: Integrate Open Source Testing Into DevOps

The single most important thing you can do is be aware of the open source packages that your developers use, and specifically which ones have vulnerabilities that can be exploited. It is critical that this review be performed as early in the development cycle as possible and that it be done continuously, since threats are constantly changing.

Forrester specifically recommended the following: “Insert a software composition analysis (SCA) tool as early in the SDLC as possible and continue to scan applications, including older applications with inconsistent or long release cycles, to ferret out newly discovered vulnerabilities.” The best way to do this is to integrate open source discovery directly into the application security testing that you are already doing — making it an essential part of your DevOps strategy.

IBM has made this process easy and transparent. With introduction of IBM Application Security Open Source Analyzer, part of IBM Application Security on Cloud, identifying open source components occurs automatically during static application security testing (SAST). These components are matched against a list of known vulnerabilities and results are returned. The results are not only actionable, but they also include specific remediation recommendations such as substituting more recent versions of the components. Results are directly integrated into reports that contain identification and remediation of vulnerabilities found in your custom code, creating a seamless adoption and use model that best enables your success.

Figure 2: Open source vulnerabilities (shown in purple) appear as Fix Groups within the scan report. For more on Application Security on Cloud Fix Groups, consult our IFA blog.

Figure 3: Clicking on the Fix Group shows vulnerability types (in this case, open source CVE), descriptions and links to recommended fixes.

Success Factor Two: Use the Most Reliable Source to Detect Open Source Vulnerabilities

Of course, no matter how seamless the integration is, it boils down to the quality of your testing results. Quality depends on a number of factors — most notably the completeness, breadth, depth and currency of known vulnerabilities and remediation recommendations.


IBM Application Security Open Source Analyzer is able to generate a comprehensive set of open source packages for evaluation by analyzing the file level during application code analysis. Those files are then compared with known open source vulnerabilities and vulnerable ones are identified, along with specific remediation advice.

The quality of IBM Application Security Open Source Analyzer data is differentiated in several important ways. The solution:

  • Supports a large number of languages: Open Source Analyzer does not merely work on a small set of languages like other solutions do. It supports a very large set, including Java, .NET, JavaScript, PHP, Node.JS, C/C++, Ruby, Python, ObjectiveC, SWIFT, Go, Scala, Clojure, Groovy, Android, Perl and Pascal.
  • Identifies a huge set of open source libraries: Across these languages, Open Source Analyzer understands more than 3.5 million binary components and nearly a half billion nonbinary source libraries.
  • Leverages a database of more than 230,000 vulnerabilities from public and private sources: IBM Application Security Open Source Analyzer has access to 12 different sources, in addition to the commonly used National Vulnerability Database (NVD). By comparison, it is estimated NVD includes fewer than 10,000 identified open source vulnerabilities. The Open Source Analyzer database is continually updated with thousands of newly discovered vulnerabilities added each month.
  • Provides actionable remediation recommendations: Our offering combines information from nearly a dozen authoritative sources, including research from the IBM X-Force team, links to patches, specific source files and newer versions that fix issues.

Peace of Mind With Application Security Testing

Embarking on a program to test your open source exposure level is the easiest and fastest way to increase your application security posture — not to mention keep your name out of the press the next time that a cute attack (or an acute attack) threatens to tarnish your organization’s good name.

Our advice is to access our complimentary trial of IBM Application Security on Cloud featuring Open Source Analyzer today, and see for yourself how easy it is to obtain the peace of mind you desire.

Start a Free Trial of Application Security on Cloud Now

More from Application Security

Containers, Security, and Risks within Containerized Environments

Applications have historically been deployed and created in a manner reminiscent of classic shopping malls. First, a developer builds the mall, then creates the various stores inside. The stores conform to the dimensions of the mall and operate within its floor plan. In older approaches to application development, a developer would have a targeted system or set of systems for which they intend to create an application. This targeted system would be the mall. Then, when building the application, they would…

Securing Your SAP Environments: Going Beyond Access Control

Many large businesses run SAP to manage their business operations and their customer relations. Security has become an increasingly critical priority due to the ongoing digitalization of society and the new opportunities that attackers exploit to achieve a system breach. Recent attacks related to corrupt data, stealing personal information and escalating privileges for remote code execution all highlight the new and varied entry points threat actors have taken advantage of. Attackers with the appropriate skills could be able to exploit…

Does Follina Mean It’s Time to Abandon Microsoft Office?

As a freelance writer, I spend most of my day working in Microsoft Word. Then, I send drafts to clients and companies across the globe. So, news of the newly discovered Microsoft Office vulnerability made me concerned about the possibility of accidentally spreading malware to my clients. I take extra precautions to ensure that I’m not introducing risk to my clients. Still, using Microsoft Office was something I did many times a day without a second thought. I brought up…

3 Reasons Why Technology Integration Matters

As John Donne once wrote, “No man is an island entire of itself.” With digitalization bridging any distance, the same logic could be applied to tech. Threat actors have vast underground forums for sharing their intelligence, while security professionals remain tight-lipped in a lot of data breach cases. Much like the way a vaccine can help stop the spread of infectious diseases, sharing threat intelligence and defense strategies can help to establish a more secure future for everyone.  So what…