{"id":2697,"date":"2018-09-26T10:38:47","date_gmt":"2018-09-26T14:38:47","guid":{"rendered":"https:\/\/solutionsreview.com\/cloud-platforms\/?p=2697"},"modified":"2018-09-26T10:40:45","modified_gmt":"2018-09-26T14:40:45","slug":"sonatype-state-of-software-supply-chain-report","status":"publish","type":"post","link":"https:\/\/solutionsreview.com\/cloud-platforms\/sonatype-state-of-software-supply-chain-report\/","title":{"rendered":"A Look at the Sonatype State of Software Supply Chain Report"},"content":{"rendered":"

\"SonatypeSonatype<\/a> today released its fourth annual State of the Software Supply Chain<\/a> report which found that software developers downloaded more than 300 billion open source components in the past 12 months and that 1 in 8 of those components contained known security vulnerabilities.<\/p>\n

Vulnerabilities have been far easier to take advantage of with the influx of open source components. The DevSecOps Community Survey of 2,076 IT professionals found that 30% of respondents believe they experienced a breach due to open source components. This is more than double last year\u2019s amount. Also, since 2014, the year of OpenSSL\u2019s Heartbleed vulnerability, open source related breaches are up 121%.<\/p>\n

The report covers the average days before a vulnerability is exploited. In 2006, vulnerabilities took an average of 45 days to be exploited. In 2017, the number dropped down to 3 days.<\/p>\n

Cryptojacking<\/a> has become a major threat to open source components. In March 2017, hackers installed backdoors, DDoS bots, cryptocurrency miners, or ransomware into applications built with Apache Struts. They walked away with at least $100,000 in cryptocurrency. This is just one of many times cryptojackers have taken advantage of system flaws in open source components.<\/p>\n

\t\t\t

\"Download<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div>\n

\u201cAs open source accelerates to its zenith of value, the underlying fundamentals of the ecosystem and the infrastructure supporting it, are increasingly at risk,\u201d said Sontatype CEO, Wayne Jackson. \u201cA series of high profile and devastating cyber-attacks last year demonstrated the intent and ability to exploit security vulnerabilities in software supply chains. This year\u2019s report proves, however, that secure software development isn\u2019t out of reach. The application economy can grow and prosper in regulated, secure environments if managed properly.\u201d<\/p>\n

Some additional key findings from this year\u2019s report include:<\/p>\n

Managed software supply chains are 2X more efficient and 2X more secure<\/strong><\/h5>\n