Jake	  Kouns
CISO
Risk	  Based	  Security@jkouns

Christine	  Gadsby
Director, Product	  Security	  BlackBerry@christinegadsby

••
•
•
•

CISO	  at	  Risk	  Based	  Security
Vulnerability	  Intelligence
Vendor	  Risk	  Ratings
Cyber	  Liability	  Insurance	  Expert
Colts	  Fan	  (yes,	  sportsball!)@jkouns• Director,	  Product	  Security• Cybersecurity	  Consultant• SEA	  to	  DFW
• Interested	  in	  safety	  critical	  systems@christinegadsby

Agenda• Part	  I:• Introduction	  to	  (OSS)	  Security	  Issues	  (brief?!)• Vulnerabilities• Legal	  Concerns• Evaluating	  OSS	  and	  3rd Party	  Libraries• Part	  II:
• Why	  OSS	  Management	  Is	  Important	  To	  BlackBerry	  • Open	  Source	  Security	  Maturity	  Model	  Presentation• Tools• Case	  Study/Cost	  of	  OSS•Sponsored	  by	  Black	  Duck	  &	  North	  Bridge•Over	  1,300	  responses•10th Yearhttps://www.blackducksoftware.
com/2016-­‐future-­‐of-­‐open-­‐source2016	  Future	  of	  Open	  Source	  Survey	  Results
90%	  of	  respondents	  said	  Open	  Source	  Improves:
Interoperability

https://www.blackducksoftware.
com/2016-­‐future-­‐of-­‐open-­‐source2016	  Future	  of	  Open	  Source	  Survey	  Results
Open	  Source	  Participation:• 67%	  of	  respondents	  report	  actively	  encouraging	  developers	  to	  engage	  in	  and	  contribute	  to	  open	  source	  projects.
• 65%	  of	  companies	  are	  contributing	  to	  open	  source	  projects.
• 59%	  of	  respondents	  participate	  in	  open	  source	  projects	  to	  gain	  competitive	  edge.
• One	  in	  three	  companies	  have	  a	  full-­‐time	  resource	  dedicated	  to	  open	  source	  projects.
https://www.blackducksoftware.
com/2016-­‐future-­‐of-­‐open-­‐source2016	  Future	  of	  Open	  Source	  Survey	  Results
Top	  Ways	  Companies	  Review	  Open	  Source	  Code:•48%	  -­‐ Development	  Teams	  manually	  keep	  track	  of	  open	  source	  usage•30%	  -­‐ Ask	  developers	  about	  open	  source	  content•21%	  -­‐ Use	  third	  party	  tools	  to	  scan	  for	  open	  source	  content
https://www.blackducksoftware.
com/2016-­‐future-­‐of-­‐open-­‐source2016	  Future	  of	  Open	  Source	  Survey	  Results
Security	  and	  Management:• 50%	  of	  companies	  have	  no	  formal	  policy	  for	  selecting	  and	  approving	  open	  source	  code.
• 47%	  of	  companies	  don’t	  have	  formal	  processes	  in	  place	  to	  track	  open	  source	  code,	  limiting	  their	  visibility	  into	  their	  open	  source	  and	  therefore	  their	  ability	  to	  control	  it.
• More	  than	  1/3	  of	  companies	  have	  no	  process	  for	  identifying,	  tracking	  or	  remediating	  known	  open	  source	  vulnerabilities.

https://www.blackducksoftware.
com/2016-­‐future-­‐of-­‐open-­‐sourceRelative	  Attack	  Surface	  vs.	  Company	  Size	  (Revenue)• Larger	  companies	  (by	  revenue)	  have	  exponentially	  more	  servers,	  more	  software,	  and	  therefore	  a	  larger	  attack	  surface	  to	  manage• Each	  server	  hosts	  on	  average	  120	  pieces	  of	  software	  counting	  versions	  as	  distinct

Open	  Source	  Software	  (OSS)• OSS	  =	  Open	  Source	  Software• Source	  code	  made	  available	  with	  an	  open	  license• Not	  just	  Linux• There	  is	  more	  than	  just	  flavors	  of	  *NIX	  operating	  systems• Not	  just	  Databases• There	  is	  more	  than	  all	  the	  open	  source	  big	  data	  options.

• Not	  just	  Applications• There	  is	  more	  than	  just	  applications	  published	  on	  Github• So	  what	  else	  is	  there?

Open	  Source	  Software	  (OSS)3rd Party	  Libraries• Developers	  using	  established	  third-­‐party	  libraries	  to:• Speed	  up	  the	  development	  process,	  accelerate	  time	  to	  market• Realize	  quality	  improvement• Rather	  than	  creating	  an	  in-­‐house	  proprietary	  solutions• Competitive	  features	  and	  technical	  capabilities• Better	  Interoperability• Better,	  Faster,	  Cheaper!

You	  Just	  Mean	  HeartBleed Right?
•While	  HeartBleed /	  OpenSSL	  helped	  raise	  awareness	  about	  3rdParty	  Libraries•We	  are	  not	  talking	  about	  OpenSSL!

Stagefright (libstagefright)

Stagefright (libstagefright)• Android’s	  Multimedia	  Framework	  library• Handles	  all	  video	  and	  audio	  files,	  playback,	  extracts	  metadata	  for	  Gallery,	  etc

• Six	  critical	  vulnerabilities	  leaving	  Android	  phones	  open	  to	  an	  attack	  delivered	  by	  a	  simple	  multimedia	  text
• All	  remote	  code	  execution• Stagefright also	  used	  in	  Firefox,	  Firefox	  OS,	  MAC	  OS	  X,	  Windows,	  also	  seen	  in	  other	  embedded	  devices	  as	  wellStagefright (libstagefright)

Symantec	  Vulnerabilities

Symantec	  Vulnerabilities

Symantec	  Vulnerabilities• CVE-­‐2016-­‐2207	  • Description	  just	  discusses	  Symantec/Norton	  products• Product	  impacted	  are	  also	  only	  Symantec/Norton	  products• And	  while	  they	  are	  affected…………………….

This	  is	  a	  3rd	  Party	  Library	  vulnerability!

Symantec	  Vulnerabilities

Symantec	  Vulnerabilities• CVE-­‐2016-­‐2211• Description	  just	  discusses	  Symantec/Norton	  products• Product	  impacted	  are	  also	  only	  Symantec/Norton	  products• And	  while	  they	  are	  affected…………………….

This	  is	  a	  3rd	  Party	  Library	  vulnerability!

Symantec	  Vulnerabilities

Liability	  – FTC	  Expanding	  RoleLiability	  -­‐ TRENDnet

Liability	  – FTC	  “concerned”

Liability	  -­‐ ASUS

Liability	  -­‐ FTCLiability

Software	  Liability	  vs	  Product	  Liability• Its	  not	  software	  that	  hurts	  the	  people,	  it’s	  a	  component	  of	  a	  larger	  finished	  product,	  making	  it	  a	  product	  failure	  not	  just	  the	  software.
• MacPherson	  v.	  Buick	  Motor	  Co.,	  217	  N.Y.	  382,	  111	  N.E.	  1050	  (1916)• Donald	  C.	  MacPherson	  was	  injured	  when	  one	  of	  the	  wooden	  wheels	  of	  his	  1909	  "Buick	  Runabout"	  collapsed• Buick	  Motor	  Company,	  had	  manufactured	  the	  vehicle,	  but	  not	  the	  wheel,	  which	  had	  been	  manufactured	  by	  another	  party	  but	  installed	  by	  defendant.

• Software	  responsibility	  is	  going	  to	  be	  on	  final	  goods	  manufacturer	  (no	  matter	  what)	  that	  is	  delivering	  the	  final	  product• If	  you	  use	  3rd Party	  Code	  in	  your	  product,	  you	  are	  responsible	  for	  the	  security	  of	  it	  as	  well!

Software	  Liability

https://www.youtube.com/watch?v=PsHgaJZVkDw

Clear	  Need	  To	  Manage	  OSS	  and	  3rd Party	  Code• “Whack	  A	  Mole”	  fixing	  of	  vulnerabilities	  is	  critical,	  not	  just	  in	  your	  own	  code!
• How	  will	  you	  be	  notified	  of	  new	  issues?
• Why	  does	  the	  cadence	  of	  release	  cycle	  matter?
• Too	  few?	  Leaves	  you	  open	  to	  risks,	  compromise	  and	  liability• Too	  many?	  Huge	  cost	  of	  ownership	  and	  potentially	  not	  possible• Need	  the	  porridge	  to	  be	  JUST	  right	  and	  prefer	  secure	  coding	  from	  the	  beginningClear	  Need	  To	  Evaluate	  OSS	  and	  3rd Party	  Code• Based	  on	  the	  issues,	  companies	  should	  evaluate	  OSS	  prior	  to	  usage!
• Companies	  need	  to	  determine	  if	  they	  think	  the	  project	  is	  mature	  enough	  to	  rely	  on• Is	  the	  project	  End	  of	  Life?	  	  Or	  still	  seeing	  regular	  updates?
• Determine	  if	  there	  are	  known	  vulnerabilities	  that	  are	  not	  fixed• Determine	  the	  true	  Cost	  of	  Ownership• Initial	  free	  usage	  looks	  amazing• But	  are	  they	  hidden	  costs	  to	  maintain	  that	  are	  not	  factored	  in	  properly?

How	  To	  Evaluate	  OSS	  and	  3rd Party	  Code• Evaluate	  The	  Viability	  Of	  A	  Project• Sponsorship?	  Risk	  that	  the	  project/code	  get	  abandoned?

• Evaluate	  The	  Health	  of	  the	  project• #	  of	  contributors	  ,	  #	  of	  updates,	  size	  of	  code	  base,	  	  etc.

• Determine	  Support	  Options• Do	  they	  publish	  security	  advisories?
• Do	  they	  have	  a	  contact	  person/vehicle	  for	  security	  reports?
• Vulnerability	  Timeline	  Metrics	  can	  help!
• How	  long	  does	  it	  take	  for	  researchers	  to	  get	  a	  response?
• How	  long	  does	  it	  take	  to	  provide	  a	  patch?

Fun BlackBerry OSS facts• 536	  unique	  libs	  tracked	  across	  75	  product	  variants• One	  single	  product	  could	  have	  195	  unique	  OSS	  libs	  • A	  product	  could	  contain 47 copies	  of	  the	  same	  library• Up	  to	  16	  different	  versions	  of	  a	  unique	  library	  in	  a	  single	  product	  Why?

***A	  commissioned	  study	  conducted	  by	  Forrester	  Consulting	  on	  behalf	  of	  Synopsys	  in	  July	  of	  2012***Why?

***A	  commissioned	  study	  conducted	  by	  Forrester	  Consulting	  on	  behalf	  of	  Synopsys	  in	  July	  of	  2012***

Engineers	  are	  like	  doctors	  and	  Ops	  are	  like	  Lawyers.	  

BlackBerry’s  Open  Source  Software  Maturity  Model

Engineers	  are	  like	  doctors	  and	  Ops	  are	  like	  Lawyers.	  

BlackBerry’s  Open  Source  Software  Maturity  Model

Engineers	  are	  like	  doctors	  and	  Ops	  are	  like	  Lawyers.	  

BlackBerry’s  Open  Source  Software  Maturity  ModelLevel 1 – Casual Chaos• Using	  OSS	  blindly• No	  understanding	  of	  risk	  or	  spread• Press	  is	  your	  vuln notification;	  media	  drives	  fear
• CEO	  calls	  and	  you	  duck	  and	  coverLevel 1 – Casual Chaos• Using	  OSS	  blindly• No	  understanding	  of	  risk	  or	  spread• Press	  is	  your	  vuln notification;	  media	  drives	  fear
• CEO	  calls	  and	  you	  duck	  and	  coverLevel 2 – Incident
Response is born
• Create	  software	  BOM
• Investigate	  and	  remediate	  public	  OSS	  vulns• Tracking	  vulns and	  fixes• Plan	  in	  place	  with	  dev	  for	  Incident	  Response	  Level 2 – Incident
Response is born
• Create	  software	  BOM
• Investigate	  and	  remediate	  public	  OSS	  vulns• Tracking	  vulns and	  fixes• Plan	  in	  place	  with	  dev	  for	  Incident	  Response	  Level 3 – Mastering Ops• Proactively	  use	  OSS	  vuln intelligence	  sources• Process	  for	  OSS	  vuln lifecycle	  • Fixes	  VS.	  Features	  with	  fix	  vehicle• Notification	  to	  customers• Security	  Researchers	  know	  where	  to	  report	  OSS	  vulns• Public	  Vuln disclosure	  policy

Level 3 – Mastering Ops• Proactively	  use	  OSS	  vuln intelligence	  sources• Process	  for	  OSS	  vuln lifecycle	  • Fixes	  VS.	  Features	  with	  fix	  vehicle• Notification	  to	  customers• Security	  Researchers	  know	  where	  to	  report	  OSS	  vulns• Public	  Vuln disclosure	  policy

Level 3 – Mastering Ops• Proactively	  use	  OSS	  vuln intelligence	  sources• Process	  for	  OSS	  vuln lifecycle	  • Fixes	  VS.	  Features	  with	  fix	  vehicle• Notification	  to	  customers• Security	  Researchers	  know	  where	  to	  report	  OSS	  vulns• Public	  Vuln disclosure	  policy

Level 4 – Tools• Using	  your	  vuln data	  proactively• Product	  Catalog	  is	  automated/tracked• Using	  tooling	  and	  automation	  to	  drive	  efficient	  vulnerability	  handling• Dev	  proactive	  involvement	  with	  security• OSS	  vuln debt	  has	  exec	  visibility

Level 4 – Tools• Using	  your	  vuln data	  proactively• Product	  Catalog	  is	  automated/tracked• Using	  tooling	  and	  automation	  to	  drive	  efficient	  vulnerability	  handling• Dev	  proactive	  involvement	  with	  security• OSS	  vuln debt	  has	  exec	  visibility

OpenSSL ‘Freak’$214K

Level 5 – Using your OSS security intelligence• #1	  put	  it	  in	  a	  box	  – minimize	  attack	  surface• Curated	  OSS	  product	  Catalog• Developers	  make	  well	  informed	  OSS	  decisions• Using	  your	  own	  product	  vuln intel	  to	  create	  smarter	  products• Proactive	  patching• OSS	  Blacklisting• Understand	  ROI

Level 5 – Using your OSS security intelligence• #1	  put	  it	  in	  a	  box	  – minimize	  attack	  surface• Curated	  OSS	  product	  Catalog• Developers	  make	  well	  informed	  OSS	  decisions• Using	  your	  own	  product	  vuln intel	  to	  create	  smarter	  products• Proactive	  patching• OSS	  Blacklisting• Understand	  ROI

Level 5 – Using your OSS security intelligence• #1	  put	  it	  in	  a	  box	  – minimize	  attack	  surface• Curated	  OSS	  product	  Catalog• Developers	  make	  well	  informed	  OSS	  decisions• Using	  your	  own	  product	  vuln intel	  to	  create	  smarter	  products• Proactive	  patching• OSS	  Blacklisting• Understand	  ROI

What will this do for me?
*Cost	  to	  manage	  free	  OSS	  in	  2015
*libpng$203,678*OpenSSL $370,690*cURL$200,345	  case	  	  	  	  	  	  	  	  	  	  	  	  	  	  	  	  resolution	  time	  	  libpng
84%
85%
OpenSSL 356%
77%
cURL88%	  	  	  	  	  	  	  	  	  	  	  	  	  	  	  	  	  	  57%***A	  commissioned	  study	  conducted	  by	  Forrester	  Consulting	  on	  behalf	  of	  Synopsys	  in	  July	  of	  2016***Benefitsof	  a	  Mature	  OSS	  Security	  Program	  As	  of	  Jan	  2016	  +87%	  increase	  in	  OSS	  ••••••

$87,837	  saved	  in	  large	  media	  events
SIRT	  filed	  401%	  more	  defects	  against	  OSS	  Cost	  of	  supporting	  OSS	  decreased	  62%	  per	  product
Intelligence	  to	  defect	  87%	  more	  efficient
Investigation	  time	  is	  46%	  faster
Fixes	  getting	  to	  customers	  12x	  faster• Thank	  you!

• Ken	  Matthews,	  Sr.	  Manager,	  PSIRT	  (BB)• Tyler	  Townes,	  Sr.	  Program	  Manager,	  PSIRT	  (BB)• Jonathon	  Brookfield,	  Director,	  Product	  Security	  Research	  (BB)• Brian	  Martin	  (RBS)• Carsten	  Eiram (RBS)• Kymberlee Price	  (BugCrowd)Jake	  Kouns
CISO
Risk	  Based	  Security@jkouns

Christine	  Gadsby
Director
Product	  Security	  ResponseBlackBerry@christinegadsby