没有合适的资源?快使用搜索试试~ 我知道了~
首页2019开源代码安全风险深度剖析:未修补的威胁与合规挑战
"本报告《2019年开源代码安全和风险分析》由Synopsys Cybersecurity Research Center发布,主要探讨了2019年开源组件在应用中的安全问题和潜在风险。报告的核心关注点在于随着智能设备的普及,开源组件的安全性成为关键挑战,尤其是如何确保这些组件已及时应用所有重要补丁,因为没有对使用的软件有清晰了解就无法有效修补。 报告指出,问题的关键并非在于是否采用开源组件,而是组件是否存在未修补的漏洞。2019年,公开揭露的漏洞数量再次创纪录,这强调了及时更新和管理开源代码库的重要性。报告详细分析了不同类型的开源许可证风险,包括那些无许可证或自定义许可证的组件,以及各垂直行业(如云计算、物联网等)中开源许可证带来的特定风险。 此外,报告还探讨了企业在使用开源组件时的操作因素,例如如何确保合规性、代码质量管理和风险管理。它提醒读者,确保商业软件中的开源部分处于良好状态是至关重要的,这关系到组织的信息安全和业务稳定性。 结论部分强调了对于开源代码安全管理的必要性,并提出了相应的建议。报告作者建议企业应采取积极措施,如定期扫描和审计代码库、实施有效的补丁管理策略、并对开源组件的许可证进行深入理解,以降低安全风险。 《2019年开源代码安全和风险分析》是一份详尽的指南,旨在帮助企业和开发者更好地理解和应对开源代码带来的安全挑战,以保护他们的应用程序和用户免受潜在威胁。"
资源详情
资源推荐
![](https://csdnimg.cn/release/download_crawler_static/12504982/bg4.jpg)
2019 | Synopsys Open Source Security and Risk Analysis | 2
ABOUT THIS REPORT
The Open Source Security and Risk Analysis (OSSRA) report provides an in-depth look at the state of
open source security, compliance, and code quality risk in commercial software.
For over 15 years, security, development, and legal teams around the globe have relied on Black Duck
®
solutions to help them manage the risks that come with the use of open source. Built on the Black Duck
KnowledgeBase™—the most comprehensive database of open source component, vulnerability, and license
information available—Black Duck software composition analysis solutions and open source audits give
organizations the insight they need to track open source in code, mitigate security and license compliance
risks, and automatically enforce open source policies using existing DevOps tools and processes.
Each year, the Black Duck Audit Services team at Synopsys conducts open source audits on thousands
of codebases for its customers, primarily in conjunction with merger and acquisition transactions. These
audits are the primary source of data for the OSSRA report. This year’s analysis examines findings from
the anonymized data of over 1,200 commercial codebases audited in 2018.
The analysis of the 2018 data took place at the Synopsys Cybersecurity Research Center (CyRC). CyRC’s
global research labs include locations in Boston, Belfast, Calgary, and Oulu, Finland.
The Boston CyRC big data research team maintains the Black Duck KnowledgeBase. This team analyzes
and refines open source activity from thousands of data sources to identify the most significant open
source projects in use.
Our Belfast team identifies the impact of open source vulnerabilities and their exploitability. Their work
forms the basis of Black Duck Security Advisories, which offer deep-sourced vulnerability data that the
team discovers, curates, analyzes, and publishes hourly.
The Calgary group works to identify coding patterns contributing to software vulnerabilities.
Our researchers in Oulu identified the OpenSSL vulnerability known as Heartbleed and continue to
perform protocol-based research.
This year, the CyRC Belfast team examined findings from the anonymized data of over 1,200 commercial
codebases reviewed by the Black Duck Audit Services team in 2018. The 17 industries represented in the
report range from aerospace to virtual reality (see the next page for a full list). The audit services team
reviewed an average of 71 codebases per industry during 2018.
Operating within the Synopsys charter of making software secure and high-quality, CyRC publishes
research such as the annual OSSRA report to support strong cyber security practices.
The 2019 OSSRA report includes insights and recommendations intended to help organizations and
security, risk, legal, and development teams better understand the open source security and license risk
landscape as they strive to improve their application risk management processes.
2019 | Synopsys Open Source Security and Risk Analysis | 1
剩余19页未读,继续阅读
![xls](https://img-home.csdnimg.cn/images/20210720083658.png)
![pdf](https://img-home.csdnimg.cn/images/20210720083512.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://csdnimg.cn/download_wenku/file_type_ask_c1.png)
![](https://profile-avatar.csdnimg.cn/636bcb78af5a408aabe7a18984b2512d_homewm.jpg!1)
不愿透露姓名的菜鸟
- 粉丝: 448
- 资源: 9
上传资源 快速赚钱
我的内容管理 展开
我的资源 快来上传第一个资源
我的收益
登录查看自己的收益我的积分 登录查看自己的积分
我的C币 登录后查看C币余额
我的收藏
我的下载
下载帮助
![](https://csdnimg.cn/release/wenkucmsfe/public/img/voice.245cc511.png)
最新资源
- Vue实现iOS原生Picker组件:详细解析与实现思路
- Arduino蓝牙小车:参数调试与功能控制
- 百度Java面试精华:200页精选资源涵盖核心知识点
- Swift使用CoreData填坑指南:CoreData在Swift 3.0的变化
- 微距离无线充电器创新设计及其实验探索
- MTK Android平台开发全攻略:44步详解流程
- RecyclerView全面解析:替代ListView的新选择
- Android开发:自动适配中英文键盘解决方案
- Android调用WebService接口教程
- Android开发:BitmapUtil图片处理全解析与实例
- Android多线程断点续传实现详解
- PCA算法在人脸识别会议签到系统中的应用
- EventBus 3.0:Android事件总线详解与实战应用
- Android FileUtil:全面解析文件操作实用技巧与实例
- RecyclerView添加头部和尾部实战教程
- Android实现微博滑动固定顶部栏实战与优化
资源上传下载、课程学习等过程中有任何疑问或建议,欢迎提出宝贵意见哦~我们会及时处理!
点击此处反馈
![](https://img-home.csdnimg.cn/images/20220527035711.png)
![](https://img-home.csdnimg.cn/images/20220527035711.png)
![](https://img-home.csdnimg.cn/images/20220527035111.png)
安全验证
文档复制为VIP权益,开通VIP直接复制
![](https://csdnimg.cn/release/wenkucmsfe/public/img/green-success.6a4acb44.png)