Security Boat Anchors: 3rd Party Products/Libraries
Dave G. | June 11th, 2007 | Filed Under: Industry Punditry
Problem Statement
One of the more interesting problems product companies face is the embedding of 3rd party applications and libraries. Apart from all of the normal support challenges, API changes and the like, you are tied to another vendor’s security posture. This includes:
How they respond to security vulnerabilities. If they sit on vulnerability reports, those are latent vulnerabilities in your product. I do not envy the vendor who tries to explain to customers why they are vulnerable. Even if it isn’t your code, it is your responsibility.
Patching release cycles. When your popular database program releases a patch that fixes 5 critical remote code execution on Monday, how do you vet out the patches and get them out to your customers? How fast can you reasonably move? Take a look at how this impacted Mac OS X with the recent Samba vulnerability.
The second issue is really challenging for vendors, as they don’t even have an early warning system in many situations. They find out at the same time everyone else does.
What Do You Do
Vendor. Perform your vendor selection for your third party components carefully. Ask them what their policies are on vulnerability disclosure. When interacting with commercial developers try and get early access to security updates so you can start your internal testing processes. For open source, you should always be tracking the projects you are leveraging.
Enterprise. Identify what third party components (and their version numbers) exist inside of the applications you purchase. This will let you track which libraries and open source/third party projects that are actively deployed in your enterprise. That should let you apply pressure on vendors when you find that your database is 9 months behind on critical security patches.
What other advice do our readers have for this problem?
Add New Comment
Viewing 9 Comments
Thanks. Your comment is awaiting approval by a moderator.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Do you already have an account? Log in and claim this comment.
Add New Comment
Trackbacks