Development of secure open source software: An Art and Science
Posted by Marbenz Antonio on September 19, 2022
A clear comprehension of the syntax of the language you are using plus some structural and logical reasoning is all that is needed to write a computer program, which isn’t all that difficult for most people.
But adding a layer of complexity to the process of developing software with a higher security posture is something that not all developers can do or comprehend. Open source is beneficial. Your code can be viewed by open-source programmers, security analysts, and auditors, who may even help you find and fix issues.
This essentially implies that the developers now have a higher obligation to produce high-quality code that is free of known vulnerabilities. It does not imply, however, that they are allowed to design insecure software with the expectation that users will fix the bugs or errors for free.
In terms of open-source development and software security, Red Hat occupies a special position. Many of our products rely on upstream open source initiatives. While Red Hat participates directly in many significant projects—either through upstream developers who work for Red Hat or through other direct and indirect contributions—other initiatives are completely independent.
This creates a special challenge, but it also offers a chance to see if using business open source software from a provider like Red Hat helps reduce risk and achieve compliance with relevant U.S. government guidelines for best practices in information security.
What do we provide for our customers?
During software development, secure software development practices are important. Before the code is built and delivered to users, design and code validation can be helpful post-developmentally. Before actually delivering software to our customers, Red Hat performs some processes, including:
- Code scanning: Before it is compiled, source code is scanned in this procedure to more effectively find security holes and weaknesses. This helps in the early detection and correction of problems. This procedure can identify problems with the way code is written, but it cannot identify logical or design errors. Red Hat believes that early identification is crucial since it helps to protect not only our customers but also the entire open source community because security fixes are sent upstream so that everyone may take advantage of the repair.
- Threat modeling: Potential risks, design flaws, and other higher-level concerns not addressed by code scanning or code audits are found using this technique. This helps us evaluate the software security controls an application needs to set effective defenses against potential threats. This aids in the cost-effective early problem resolution and security posture improvement of any application.
- Software bill of materials (SBOM): Knowing exactly what you are delivering is crucial in determining the security posture of open source goods because they typically consist of numerous smaller projects. This aids Red Hat Product Security in managing vulnerabilities effectively.
6 tips for open source developers
There are some things you can do as an open-source software developer or project leader to contribute to the creation of better safe software.
1. Learn everything you can
A smart place to start is by learning about security and secure coding practices. Online, there are some resources, the majority of which are free (in the genuine open source spirit), including:
- Secure Software Development Fundamentals Courses from OpenSSF is an excellent starting point.
- You’ve Got Microservices from Red Hat Developers… Let’s Protect Them! discusses protecting microservices and provides links to additional secure code instructions.
- If you’re interested in learning about linguistic peculiarities, etc., the Fedora project defensive coding guide is a great place to start.
- Check out the CVE database of previously discovered security weaknesses as well. These usually have references linked to them, which makes them useful for learning how the vulnerabilities were created in the first place.
2. Get your code peer-reviewed
- The good news is that if you work on a development team, your coworkers can already peer-review your code before you commit.
- If you are a sole developer, no problem! It should be OK to request assistance on public forums or mailing lists. Simply have a second set of eyes go at your code—it always helps!
3. Use free security tools
- On the internet, there are several free security analysis tools to choose from. You could use anything from free source code scanners to threat modeling tools to binary analysis tools from this list.
- Even those that give away the very minimum of functionality for free can offer valuable insights into your project.
4. Have a process to respond to vulnerabilities
- Secure software development involves not only finding defects early but also fixing problems that are found after code has been sent to clients and users.
- Make sure this is appropriately promoted on the project page and have a way where security issues can be reported (perhaps an email address). Think about how you want to handle this because some journalists only prefer to send encrypted emails.
- Be prompt in your responses to reporters. Customers and users should be informed whether their version of the product is vulnerable or not by security advisories that are converted from any issues fixed and placed on the project page.
5. Network and keep yourself updated
- Doesn’t this hold in all situations? Spend a few additional cycles keeping up with the most recent attacks and tools available as a developer you keep yourself informed with the newest technology or even languages. It should all be worthwhile in the end!
6. Understand your weakest links
The saying “A chain is only as strong as its weakest link” is well known. The same is true for the creation of secure software. Although you as a developer take every precaution to make your code as secure as you can, there are still additional considerations. Here are a few things to remember.
- How secure is the build toolchain you use? How secure are your compilers, linkers, and other build toolchain elements if you are releasing pre-built binaries with your code? When building, are the proper flags being used?
- What server hosts your source code? Who else has access to the code if it is a cloud-based git repository, and how secure are your login credentials?
- Do your source-code tarballs have signatures? Use any contemporary tools, such as sigstore, to assure transparency.
Conclusion
It takes time to train developers and reviewers to have the proper mentality for this process of thinking about securely constructing your code. However, a thorough approach ultimately benefits both the creators and the code’s users. If you’re a developer, there is a ton of support available; all you need to do to get started is master the appropriate techniques and tools.
Here at CourseMonster, we know how hard it may be to find the right time and funds for training. We provide effective training programs that enable you to select the training option that best meets the demands of your company.
For more information, please get in touch with one of our course advisers today or contact us at training@coursemonster.com
