Modern software development makes extensive use of open-source libraries that save development time and money. However, 79% of developers fail to keep those libraries up to date leaving their code vulnerable to newly discovered flaws and vulnerabilities.

A new report from testing firm Veracode reveals some worrying trends that Security Managers should discuss with their colleagues in the software development team.  Interesting revelations include:

• 92% of flaws in open source libraries can be fixed simply by updating to the latest version, yet 79% of the time the included libraries are never updated after they are first imported into the code.
• 70% of the time, the reason libraries with known vulnerabilities are not updated is simply down to no resource being allocated to the task in the development team.

Based on 13 million scans of over 301,000 libraries, Veracode discovered that software written in Ruby and Javascript is most likely to missing library updates that fix known vulnerabilities.

Source Code Vulnerability Scans

System Administrators are used to performing vulnerability scans on operating systems and deployed web applications.  Developers may well be subjecting their source code to some form of scan or analysis in order to spot security vulnerabilities and coding errors.  With the prevalence of third-party libraries in most modern software projects, another type of scan or process is needed – a regular check of all those imported libraries in order to identify known vulnerabilities or new versions available that should be included in the next version of your software build.