Requirement that proprietary software using OSS be returned to the commons with OSS licensing.Owing credit and/or renumeration to the contributing developer(s) or project teams.With hundreds or thousands of these components in a typical software supply chain, it is easy to see how complications arise.Ĭommonly understood problems borne from incorrect use of OSS licenses include: However, every component is released with a different license, and a different set of terms. Risks Associated with Not Understanding OSS LicensesĪn OSS license grants others permission to modify, use, and distribute software under certain conditions. Yet, the dangers of ignoring or misusing licenses are more insidious than they appear at first glance. Only 12% of Gartner respondents selected licensing issues as their number one concern.

In most modern DevOps development projects, the majority of code used in an application is made up of open source - with the remaining code largely serving as “glue” to assemble and invoke the various functions.” Emphasis added. “One vendor-conducted study revealed 96% of codebases examined contained at least some open source, and 40% of those packages contained at least one high-risk vulnerability. (OSS without an explicit license should never be used because the authority to do so is unclear.) So how could these licenses be overlooked, ignored, or dismissed? It starts with the sheer volume of OSS in a typical application. Most open source components include licenses. Virtually all contemporary, proprietary software incorporates OSS components. Operating without license compliance, intentionally or not, invites peril. Open source software (OSS) licensing is an important governance consideration its management is central to secure development. Gartner’s third recommendation elevates governance of open source software (OSS) licensing.

The second recommendation is to “harden” the software supply chain in other words, reinforce all internal and external code so that the entire system is more resilient. The first is to ensure a software bill of materials (or SBOM) exists for every software application an SBOM illuminates all component parts and assists with rapid remediation, when necessary.

Gartner’s report, Technology Insight for Software Composition Analysis, makes four recommendations to improve software security.

Open source license manager