Having been at ActiveState for practically eight years, I’ve seen many iterations of our product. Nonetheless, one factor has stayed true over time: Our dedication to the open supply neighborhood and corporations utilizing open supply of their code.
ActiveState has been serving to enterprises handle open supply for over a decade. Within the early days, open supply was in its infancy. We centered primarily on the developer case, serving to to get open supply on platforms like Home windows.
Over time, our focus shifted from serving to firms run open supply to supporting enterprises managing open supply when the neighborhood wasn’t producing it in the best way they wanted it. We started managing builds at scale, and supporting enterprises in understanding what open supply they’re utilizing and if it is compliant and protected.
Managing open supply at scale in a big group will be complicated. To assist firms overcome this and convey construction to their open supply DevSecOps observe, we’re unveiling our end-to-end platform to assist handle open supply complexity.
The present state of open supply and provide chain safety
It is inevitable that with the hovering recognition of open supply comes an inflow of safety points. Open supply adoption in fashionable software program purposes is critical. Over 90% of purposes comprise open supply parts. Open supply is now on the core of how we produce software program, and we have hit some extent the place it is the first vector for dangerous actors to get entry to almost any piece of software program.
Assaults have been round perpetually, however there’s been an growing variety of incidents in recent times. The pandemic surfaced new alternatives for dangerous actors. When folks have been utilizing their very own residence networks and VPNs with much less stringent safety measures, it began to permit for extra danger. Regardless of return to workplace efforts, many IT staff are nonetheless at residence, so these alternatives nonetheless exist.
Moreover, many enterprises do not have processes in place for the way they select and procure open supply software program, so devs blindly discover and incorporate it. The problem is firms then do not know the place open supply code is coming from, who constructed it, and with what intentions. This creates a number of alternatives for assaults to occur all through the open supply software program provide chain course of.
Open supply is an open ecosystem, which makes it susceptible ‘by design.’ It must be as open as attainable to not hinder authors from contributing, however there’s an actual problem of retaining it safe all through the whole growth course of.
Dangers do not simply exist if you’re importing. In case your construct service is not safe if you begin constructing, you will be in danger. Lots of the most up-to-date assaults we have seen are open supply software program provide chain assaults not vulnerabilities. This requires an entire new strategy to open supply safety.
Reimagining the open supply administration course of
At ActiveState, it is our mission to carry rigor to the open supply provide chain. Firms can get higher visibility and management over their open supply code throughout DevSecOps by specializing in a four-step administration cycle.
Step 1: Discovery
Earlier than you’ll be able to even start to remediate vulnerabilities, you could know what you are utilizing in your code. It is vital to take stock of all of the open supply that is working inside your group. An artifact of this effort might appear to be a dashboard.
Step 2: Prioritization
After getting the dashboard, you can begin analyzing for vulnerabilities and dependencies and prioritize which to concentrate on first. Understanding the place the dangers are in your codebase and triaging them will allow you to make knowledgeable choices about subsequent steps.
Step 3: Upgrading and curating
Now comes the remediation and alter administration section. You will need to set up governance and insurance policies for managing open supply throughout your org to maintain everybody aligned throughout features and groups.
You also needs to carefully handle what dependencies are utilized in each manufacturing and growth environments to attenuate danger.
In our platform, we preserve a big immutable catalogue of open supply software program. We maintain a constant, reproducible file of round 50 million model parts, and we’re continually including to it. It helps our customers be sure that they’ll at all times get again to reproducible builds. It means you’ll be able to curate the whole web for open supply whereas trusting it is safe.
Step 4: Construct and deploy
The construct and deploy section includes incorporating safe and protected open supply parts into your code – since you’re not likely remedied and safe till the fixes are deployed. At ActiveState, we construct and monitor all the things. From once we ingest supply code to once we construct it right into a safe cluster. We then give it to you in a wide range of codecs to be deployed relying in your wants. We’re the one answer (that we all know of) that really helps firms remediate and deploy, finishing the complete lifecycle of making certain software program provide chain safety.
A brand new ActiveState: tackling open supply safety challenges head-on
By way of our work in open supply over the previous decade, we have found there is a hole between the passionate communities producing open supply and the enterprises that need to use it of their software program. We’re now serving to to shut that hole, empowering the open supply ecosystem whereas bringing safety to organizations.
The refreshed platform we have developed and centered on facilitating collaboration between numerous gamers throughout organizations, together with builders, DevOps, and safety. Our platform helps groups easily run a steady cycle of managing open supply.
There are six key use instances we’re centered on serving to groups drive outcomes round.
- Discoverability and observability: Achieve full perception into all the things from open supply utilization to deployment areas.
- Steady open supply integration: Hold your code up-to-date, keep away from breaking modifications, and remove danger.
- Safe surroundings administration: Be sure your dev, check, and manufacturing environments are constant and reproducible.
- Governance and coverage administration: Preserve a curated open supply catalogue with out slowing down growth occasions.
- Regulatory compliance: Mechanically adjust to authorities laws and speed up safety opinions.
- Past end-of-life assist: Keep secure and safe even after programs attain finish of life
In case your staff can use assist for any of those use instances, our new platform may also help. Discover the refreshed ActiveState platform with a Platform Enterprise Trial right this moment.
Be aware: This insightful article is delivered to you by Pete Garcin, Senior Director of Product at ActiveState, sharing his experience and distinctive perspective on the evolving challenges and options in open supply administration.
