They Wait Until the Software Flaw Trends on Twitter

May 03, 2013
By Derek Weeks

2 minute read time

Here is another post on my favorite quotes from the Security at the Speed of Development webinar with Wendy Nather, Research Director, Security for 451 Research and Ryan Berg, Sonatype CSO. Wendy was talking about how inertia makes it difficult to justify fixing security flaws later in the SDLC:

• "Management will want to wait until there is an actual breech before they bring resources back to fix it."

• "That big corporation (with the 3 or 4 letter acronym) will wait until their software flaw is trending on Twitter before they will do something about it."

• On the resource commitment: "Fixes through change management... traceability for every fix you make... getting the builds done... rebuilding it will be difficult... testing will take time... you may not have a slot in QA... and then there is deployment."

Wendy also noted the need to protect the entire supply chain, including assets sourced from third parties. Her Twitter reference implied that some suppliers will not address security flaws until negative publicity forces them to act.

There are multiple reasons flaws are not fixed: lack of budget, poor project planning, shifting resources, etc. Another factor is that today's security tools focus on discovery, they don't help you fix problems. Ryan went on to say:

• "We don't have a problem finding problems, we have a problem managing what we have. And to make sure that when we make a change or a fix, it rolls through the entire development lifecycle into production."

We took this challenge into account when we designed the Sonatype CLM. Not only does the CLM help you identify security, licensing and quality flaws, it helps you prioritize and fix the problems directly in the IDE.

• The flawed components are prioritized by an aggregate threat level.

• The developer can find a suitable replacement for the component without leaving the IDE.

• The developer can see the components side-by-side to assess change impact.

• The code can be refactored automatically by pushing a button in the IDE.

To see how you can fix flaws with the Sonatype CLM, check out the "Quickly identify your exposure and remediate flaws" section of the product tour.

Make sure you read Wendy's research Mission Impossible: securing the open source software supply chain with Sonatype.

Written by Derek Weeks
Derek serves as vice president and DevOps advocate at Sonatype and is the co-founder of All Day DevOps, an online community of 65,000 IT professionals.