DECEMBER 2023

The guide to managing
open source software risk
with Tidelift
LEARN HOW TO PROACTIVELY REDUCE
RISK, IMPROVE SECURITY, AND USE
OPEN SOURCE WITH CONFIDENCE

What’s covered in this guide03 INTRODUCTION18

HOW ORGANIZATIONS USE TIDELIFT
19. Validated open source package intelligence
20. Open source management and policy compliance
21. Compliance with mandatory government
cybersecurity requirement

08

22THE TIDELIFT SUBSCRIPTION

04. The beneﬁts of open source
05. The hidden challenges of open source

11

HOW ARE MOST ORGANIZATIONS APPROACHING
THIS ISSUE TODAY?

HOW CAN ORGANIZATIONS MANAGE OPEN
SOURCE SOFTWARE SUPPLY CHAIN SECURITY
EVEN MORE EFFECTIVELY?

24. Insights
25. Visibility
26. Management

28

WHY NOW?

12DEFENSE-IN-DEPTH

29

ABOUT TIDELIFT

15

WHERE TIDELIFT COMES IN

31

GETTING STARTEDIntroduction

INTRODUCTION

The beneﬁts of open source
Open source is the modern application development platform
These days, open source is everywhere.
Using open source gives anyone trying to innovatewith software a head start, with billions of lines ofcode freely available, developed, and shared throughan open community of creators, collaborators, andmaintainers.
Open source helps increase developer productivity,accelerates development and deployment, andreduces application development costs.
However, it comes with hidden costs related tokeeping it secure and well maintained.

92%
of applications
contain open sourcecomponents

Open source code
makes up 70%
or more of theaverage application

Source: 2018 Tidelift open source survey
4

INTRODUCTION

The hidden challenges of open source
60% of open source projects are maintained by unpaid
hobbyists. These volunteer maintainers often lack thetime and incentives to implement the secure softwaredevelopment practices enterprise users require, not tomention that security and maintenance practices vary
widely from project to project.
This in turn forces organizations to take on theresponsibility for ensuring their open source software
supply chain is secure and well maintained—extremely
research-intensive and time-consuming work.

Source: 2023 Tidelift maintainer survey

5Looking at this through the lens of an open source package
maintainer, as Seth Michael Larson, maintainer of urllib3, a
popular Python package with billions of downloads a year, put it:“Being a maintainer of an open source projectrequires running fast just to stay still. Every
project requires security responses with ﬁxes,
updates to dependencies, and support for new
language versions, features, and platforms. Whenthe amount of work demanded from maintainers
becomes too much we lose maintainer time toburnout, disinterest, and frustration.”– Seth Michael Larson, “People in your software supply chain,” May 31, 2022

6

Did you know?
In 2023, more than three-ﬁfths (61%)
of U.S. businesses have been directly
impacted by a software supply chain threat.
(Capterra; Infosecurity Magazine)

7

So, how are most organizations
managing open source
software risk today?

How are most organizations managing
open source software risk today?
Historically, software composition analysis(SCA) tools have been a common way fororganizations to manage open source security
issues. They are good at identifying known
security vulnerabilities and helping
organizations respond to them, but are only
part of the solution.

DON’T EATSPOILED FOOD

SOURCE BETTERQUALITY FOOD

SCA is really good athelping your organization
ﬁx known vulnerabilities
in open source.

But you also can makeactive decisions to bring inopen source componentsthat are being developed
securely in the ﬁrst place!

ANDTo turn analyzing open source into a foodmetaphor, SCA is strong at showing you whenfood is spoiled…but you also need a strategy
for sourcing better quality food as well.

9Organizations using SCA tools still typically struggle with:●●●●

Too much vulnerability data to digest. In 2022 there were over 17K new vulnerabilities.
Developers complaining about being slowed down by having to diﬀerentiate between real issues andfalse positives.
Developers not knowing how to remediate CVEs or how to prioritize which CVEs to address ﬁrst.
Vulnerabilities leading to work stoppages and causing rework while development teams are expected todeliver on tight deadlines.

The bottom line:
We are living in an era where reacting to late-stage risk alone is no longer
enough to secure your organization's software. By the time an SCA tool has
discovered a vulnerability, it’s too late because the vulnerability is already inyour software development lifecycle. Open source software supply chain
threats are much broader than what CVEs tell us. More and more,organizations are starting to recognize the importance of minimizing thelikelihood of being exposed to a vulnerability in the ﬁrst place.
10

How can organizations manage
open source software supply chain
security even more eﬀectively?

Defense-in-depth
At Tidelift, we recommend organizations take a more holistic,
defense-in-depth approach to open source software supply
chain security that combines reactive tools such as SCA together
with a more proactive solution.
SCA tools are very eﬀective at identifying and helping remediate
current, known risks and vulnerabilities. This helps you close oﬀ
already identiﬁed attack vectors.
Additionally, you should also implement a proactive approachthat helps protect against future issues. This includes ensuring
the open source projects your organization uses are developed
using secure development practices, so you can minimize thelikelihood that issues will impact you in the ﬁrst place.

12

Proactive and reactive strategies deployed together can improve thesecurity of your organization’s open source software supply chain.

13

Some examples of proactive decision-making that canhelp protect your organization against future issues:
Is the open source software you use deprecated?
Is the open source software you use still maintained or abandoned?
Is the open source software you use responsive to security issues?
and more

14

This is where Tidelift comes in
In partnership with paid open source maintainers, Tidelift provides accurate,
human-researched, maintainer-validated data about how the open source
your organization relies on is secured and maintained, allowing you to makebetter proactive decisions and manage future risk when using open source.

Tidelift documents the secure development practices ofthe open source projects organizations rely on mostTidelift pays open source maintainers to ensure their projects follow industry-standard secure software development practices(such as those found in the NIST Secure Software Development Framework and the OpenSSF Scorecards).

Examples of the standards
implemented by Tideilift’s
partnered maintainers:

TIDELIFT’S MULTI-YEAR PARTNERSHIPWITH MAINTAINERS HAS INCREASEDOVERALL SCORES BY 57%
Through a focused eﬀort on scorecards starting in
June of 2022 to May 2023, Tidelift increased OpenSSF
scorecard scores from an average of 6.5 to 7.2 (n=26),
increased maintainer engagement with scorecards,
and improved how scoring is assessed.

16

How organizations use Tidelift tomanage open source software risk

How organizations use Tidelift

Validated open source security
and maintenance data

Open source management
and policy compliance

Compliance with mandatory
government cybersecurity
requirements

Use Tidelift’s package, release,and vulnerability APIs to give
your teams access to acontinuously curated stream ofvalidated data about vetted
components they need to makeintelligent decisions, faster.

Create catalogs of vetted,
approved open sourcecomponents that follow secure
software development
practices, then continuously
curate them against the set oforganizationally-deﬁned open
source policies.

For organizations selling
software to the U.S.
government, get the data youneed to attest to the securedevelopment practices of theopen source components usedin your applications.

18Validated open source package intelligence
BENEFITS

For organizations that rely heavily on
open source software but struggle tounderstand how speciﬁc open sourcecomponents might make them more
susceptible to vulnerabilities and attacks.

Open source intelligence data at scale.
Tidelift has built a uniﬁed, cross-ecosystem data
model covering millions of open source packages.
Reduce time spent analyzing packages and makebetter decisions with ﬁrst-party data about secure
software development practices, release guidance,
licensing information, and more.
Data where you need it. Access these insights via
APIs, with the ﬂexibility to pull it into your preferred
workﬂows and tools.

19Open source management and policy compliance
BENEFITS

For organizations that rely heavily on open
source software but struggle with a lack ofvisibility regarding package usage acrossthe organization and have development
teams downloading packages that havenot been evaluated against organizationalrisk parameters, adding concerns about
open source security risks.

Improve visibility. Get a complete view of open source in
use across the organization, including transitive
dependencies, generate up-to-date SBOMs after everybuild.
Improve decision-making. Make more informed decisions
with human- researched, validated, and normalized
metadata—and share them across the organization.
Improve management. Centralize open source security,maintenance, and licensing policies and standards whileempowering developers to self-serve from catalogs ofapproved components.
Improve resilience. Validate that the components you use
meet industry and government standards—now and into
the future.
20

Compliance with mandatory government
cybersecurity requirements
BENEFITS

For organizations selling software to theU.S. government that are required to self
attest that they follow the securesoftware development practices outlinedin the NIST Secure Software
Development Framework (SSDF).

Tidelift is the only source for ﬁrst-party
attestation data from the maintainers behind
thousands of open source packages that go into
your software, aligned to the U.S. government’s
NIST Secure Software Development Framework(SSDF) standards. In addition, we provide:
A standardized attestations report, to be usedas evidence that the open source
dependencies in your organization’s
applications follow secure softwaredevelopment best practices.
A solution for dynamically tracking
attestations for open source components
going into your product, and keeping theattestations current in an automated manner.
21

The Tidelift Subscription

Product capabilities
The Tidelift Subscription provides a proactive approach to reducing risk byhelping organizations make better-informed decisions about open source software.

Insights

Visibility

Management

Proactively evaluate the security,licensing, and maintenance risksof open source software using
Tidelift’s centralized, structured,and continuously curated
database of insights spanningmillions of open source packages.

Ensure stakeholders are able torespond to issues andvulnerabilities by giving themappropriate visibility aroundopen source software usage
across the organization.

Mitigate long-term organizationalrisk by standardizing open source
software management practices
and policies across theorganization.

23

INSIGHTS

The easiest way to avoid having to replace
problematic open source dependencies is to
not bring them in at all.
Organizations rely on Tidelift to assist inreviewing new open source software being
considered for use, ensuring it:
Matches their license policy
Has a history of responding to security and other issues
Is actively maintained and receiving ﬁxes
Has ﬁnancial support to ensure long-term viability

Tidelift provides a one-stop
shop for answering thesequestions. Open source
program oﬃces save thetime they would have spentresearching, meaningdevelopers can get answers
faster, and security andlegal departments havepeace of mind byproactively reducing risk.

and more
24

VISIBILITY
With Tidelift, organizations can:Having visibility into theopen source software
being used across theorganization is critical forunderstanding the impactof a vulnerability andundertaking appropriate
remediation eﬀorts in atimely manner.

Build a centralized inventory of all the open source
packages being used by generating or importing
software bills of materials (SBOMs) in CycloneDXand SPDX formats
Easily implement remediation by mapping how andwhere a speciﬁc package or release came into yoursoftware dependency chain
Prioritize remediation actions by identifying
whether a package is being used in a runtime ortest environment
Evaluate dependency information, correctly catalog
direct and transitive dependencies, and map how
speciﬁc dependencies are being pulled into theircodeand more25

MANAGEMENT

Reviewing new open source packages underconsideration to understand their development
practices is a good thing. But it’s not a one-time
solution; it is equally important to monitor theopen source components your organization uses
in an ongoing manner. Software can bere-licensed, newer versions are constantly being
released, maintainers can lose funding tocontinue maintenance, or can walk away andabandon or deprecate a package at any time.
Tidelift continuously analyzes open source
software and keeps you informed of changes as
they happen, not months or years later when alatent vulnerability is discovered and no one’s
there to ﬁx it.

We’ve built out-of-the-box functionality that
automates long term open source management
by providing answers such as:
Has a previously approved package been
exposed to a new vulnerability?
Did an actively maintained package become
deprecated, thus introducing new riskvectors?
Are you correctly tracking license
information and ensuring that previously
reviewed and approved license information
has not changed?
Are your developers using older, outdated
versions or deprecated packages that mightnot be supported, or expose you to newvulnerabilities?
and more26

It’s time to get proactive about
reducing open source security risk

Why now?
Open source changes at a breathtaking rate in modern softwaredevelopment. Development teams make many choices each day about
what packages to start or stop using. Impacting these choices arethousands of dependency graphs, where package maintainers are also
making choices continuously. New versions ship, security weaknesses
emerge, packages are abandoned, and contributors change.
We are living in an era where reacting to late-stage risk alone is no longer
enough to secure your organization's software. There are too many
vulnerabilities to respond to. Open source software supply chain threats
are much broader than what CVEs tell us. And managing all of this at scale
is overwhelming.
Tidelift is designed to be your organization’s proactive defense-in-depth
strategy for protecting your open source software supply chain. We havebuilt tooling that delivers insights, visibility and management at scale
across millions of open source packages.

28About Tidelift

About Tidelift
Tidelift helps organizations improve thehealth and security of the open source
powering their applications. We partnerwith leading open source maintainers toprovide human-validated data about thesecure development practices followedby the world’s most critical open source
projects. Tidelift enables organizations
to use open source with conﬁdence,
so they can create more incredible
software, even faster.

SELECTED CUSTOMERSINVESTORS

30

Getting started
Watch a demo of theTidelift Subscription
See how the Tidelift
Subscription can help yourorganization use open sourcewith conﬁdence, so you cancreate more incrediblesoftware, even faster.

Visit ourresource library
Learn more about developing
an eﬀective strategy for
managing open source
through our guides, videos,and webinars.
EXPLORE OUR RESOURCES

WATCH THE DEMO

Get in touch
Contact us to schedule a time
to chat live and learn more
about how Tidelift can help
you.
CONTACT US

Get detailed technicalinformation about the Tidelift
Subscription.
VISIT OUR TECHNICAL DOCUMENTATION

31