Liran Tal — Open Source Security — 5 Minute AppSec

0:00Chris RomeoThis is 5 Minute AppSec. Our guest is Liran Tal. The topic is open source security. Why should someone care about open source security?

0:10Robert HurlbutSo caring about open source security is kind of something that you would want to bake into your developer workflow, right? Because you are developing software, you know, you do not want to be that, that person responsible for a data breach. You actually want to develop really good quality applications. I think security is like you own a house, maybe you live in an apartment, you do not want to leave the window open, the door open, or something unlocked. You would think twice, I closed everything, everything is shut down, everything is okay, I can go out. It's like shipping software. You're shipping something, it's out there in the wild, malicious users could access it just as well. You probably don't want to leave any of those backdoors open. It's like a very good sense of responsibility and accountability of what you build. That doesn't go into just what you build and own accountability, but also if you think about it, as developers, we build things and we have an accountability not just towards ourselves and the company and the organizations that we work for, but also for the users that actually use that.

1:12Liran TalData breaches that may happen because we were using an outdated vulnerable open-source library or we were using a cryptography protocol algorithm that was out of date. We would want to be more conscious into the decisions that we're making in our applications throughout the software development lifecycle in terms of how we bake in security, how we take that into an account, just as if we were making sure that our code is tested, it is accessible, the website, if you're developing something that needs accessibility, if it is something that is performance. On Black Friday or whatever, you would be having a lot of hits on the website, on your code, you want to make that overly performant. The same way, I think that we want to care about the security of application as that is something that it is very hard, I think, to put an ROI around it and prioritize ahead of time. But once something bad happens, it just feels really, really bad. I think at least from accountability ownership, I think this is something we want to be a lot more careful with and responsible for.

2:26Chris RomeoCatch our full interview with Laurent where we talk about open source and third-party software security, and we go into some of the research that he's done, and he shares a few nuggets with us along the way.