Enterprise-Driven Open Source Software: A Case Study on Security Automation

Abstract

Agile and DevOps are widely adopted by the industry. Hence, integrating security activities with industrial practices, such as continuous integration (CI) pipelines, is necessary to detect security flaws and adhere to regulators' demands early.In this paper, we analyze automated security activities in CI pipelines of enterprise-driven open source software (OSS). This shall allow us, in the long-run, to better understand the extent to which security activities are (or should be) part of automated pipelines. In particular, we mine publicly available OSS repositories and survey a sample of project maintainers to better understand the role that security activities and their related tools play in their CI pipelines. To increase transparency and allow other researchers to replicate our study (and to take different perspectives), we further disclose our research artefacts. Our results indicate that security activities in enterprise-driven OSS projects are scarce and protection coverage is rather low. Only 6.83% of the analyzed 8,243 projects apply security automation in their CI pipelines, even though maintainers consider security to be rather important. This alerts industry to keep the focus on vulnerabilities of 3rd Party software and it opens space for other improvements of practice which we outline in this manuscript.

Ambush From All Sides: Understanding Security Threats in Open-Source Software CI/CD Pipelines

“…There are also research studies on bridging the gap between agile development and security auditing. Angermeir et al analyzed the enterprise-driven open-source software and corresponding security automation on a large scale, indicating that security activities in enterprise-driven OSS are scarce and the protection coverage is low [33]. Türpe et al revealed the isolation between scrum CI/CD framework and security experts [34].…”

Holding on to Compliance While Adopting DevSecOps: An SLR

“…Such technologies advocate automation which is considered a backbone of DevSecOps workflow implementation [70]. Automated security has begun to consider the panorama of challenges by bridging the gap between compliance with security standards and the software engineering environment itself [20]. The opportunity to integrate compliance aspects into the DevOps methodology makes the process a matter of automation as well.…”

“…The use of security tools as an embedded component allows the automation of security testing [43]. Security activities such as Third-Party Vulnerability Scanning, Static/Dynamic Application Security Testing [20], security requirements testing, threat mitigation testing, vulnerability testing, and penetration testing [61] were performed to test for security risks. Security testing itself contributes to the application of compliance testing.…”

“…On the other hand, the automation of system configurations itself will ensure that manual errors are avoided and compliance is ensured [43]. Moreover, it will facilitate the compliance verification process, given the security configuration applied and compliance checks on the configuration [20].…”

“…With an industry that is widely embracing and adopting DevOps [19], the integration of security processes in pipelines is turned into a must, which has resulted in DevSecOps. These pipelines not only support the detection of any security vulnerabilities, but also contribute to the adherence to standards and regulations [20]. In addition to the protection of customers that the adherence to regulations or the state of being compliant offers, it protects the product provider as well.…”