INNOVATION’ S GREATEST ALLY AND ITS WEAKEST LINK
Peter Lees, VP & Head of Solutions,
Asia Pacific at
SUSE, discusses why enterprises can’ t abandon open source, but why blind trust in communitymaintained code is no longer good enough. pen source software is the
O tap water of the digital age. It flows into almost every enterprise system, sustaining the applications we depend on every day. But like tap water, it isn’ t always safe to consume straight from the source. Unless it’ s filtered, treated and checked, the very thing keeping us alive can just as easily make us sick.
The brilliance of open source lies in its openness. Anyone can contribute, audit and improve the code. But that same openness gives attackers an unrestricted view of the blueprints.
Publicly available code lets both researchers and cybercriminals find flaws; this community-driven maintenance, another strength of open source, can unfortunately turn into a liability, especially for smaller or abandoned projects that can wait weeks or months for patches. Enterprises frequently run outdated versions of libraries, leaving known vulnerabilities exposed simply because upgrades are inconvenient.
Modern software also rarely runs on a single component. It’ s built on sprawling dependency chains, where a forgotten or unobtrusive package buried many layers deep can provide the weak point an attacker needs: we’ ve already seen malicious actors intentionally inject compromised packages into public repositories, planting digital landmines for enterprises that blindly pull them in.
The result is a paradoxical picture; open source accelerates innovation while simultaneously making organisations more vulnerable. It’ s important to acknowledge that the openness of the source makes discovery of vulnerabilities – intentional or otherwise – much easier than if closed-source code is compromised, but the rise of AI-powered code analysers has meant that openness can be exploited much faster than ever before.
Yet abandoning open source is impossible. Its ubiquity is exactly why it’ s indispensable. Developers lean on it to move fast, avoid
24
INTELLIGENT CIO APAC www. intelligentcio. com