Open-source security rests on understanding risks, scaling fixes

Dive Brief:

• The open-source software community needs to understand several key lessons in order to improve its cybersecurity posture, according to IBM, which operates a clearinghouse for analyzing and disclosing open-source vulnerabilities.
• “Finding a vulnerability is only the start,” IBM said in a report published on Thursday. “Security teams must understand the risk, determine whether action is needed, find a usable fix, then get that fix to the software that needs it.”
• The new report — the first in a series collecting insights from IBM’s clearinghouse — is meant to help software maintainers and their customers, including businesses, better understand systemic risks in the open-source ecosystem.

Dive Insight:

With so many vulnerabilities plaguing open-source software, the only way to effectively protect the community is to triage the most serious flaws and distribute their fixes effectively, according to…