Software supply chain report focuses on open source impact

By actively governing the flow of open source components organizations are improving application quality and developer productivity.

Sonatype has released its third annual State of the Software Supply Chain Report. This year’s report highlights risks lurking within open source software components and quantifies the empirical benefits of actively managing software supply chain hygiene.
Organizations that are actively managing the quality of open source components flowing into production applications are realizing a 28 percent improvement in developer productivity, a 30 percent reduction in overall development costs, and a 48 percent increase in application quality. Furthermore, analysis of more than 17,000 applications reveals that applications builtby teams utilizing automated governance tools reduced the percentage of defective components by 63%.
Conversely, organizations failing to manage software supply chains are unwittingly releasing vulnerable applications into production, wasting thousands of hours on rework and bug fixes, and facing increased liability due to gross negligence.
Additional key findings of the 2017 State of the Software Supply Chain report include:
Consumption of open source components is growing on a massive scale
  • Year-over-year downloads of Java components grew 68 percent (52 billion in 2016), JavaScript downloads grew 262 percent (59 billion in 2016), and demand for Docker components is expected to grow 100 percent (12 billion downloads).
  • Faced with a near infinite supply of open source components, high-functioning DevOps organizations are utilizing machine automation to govern the quality of open source components flowing through their software supply chains.
Open source component suppliers remain slow to fix vulnerabilities
  • Even when vulnerabilities are known, OSS projects are slow to remediate - if they do so at all. Only 15.8 percent of OSS projects actively fix vulnerabilities, and even then the mean time to remediation was 233 days.
  • This puts the onus on DevOps organizations to actively govern which OSS projects they work with, and which components they ultimately consume.
Number of downloaded components with known vulnerabilities is slightly decreasing
  • In 2016, the percent of Java components downloaded from the Central Repository that contained known security vulnerabilities fell to 5.5 percent (1 in 18), down from 6.1 percent the year prior.
  • Although this defect download ratio is far from perfect, there is empirical evidence that hygiene is beginning to improve with ratios declining slightly in each of the last three years.
The regulatory landscape is rapidly changing
  • In the past year in the United States, the White House, four federal agencies, and the automotive industry have released new guidelines to improve the quality, safety, and security of software supply chains.
The balance of deploying secure applications vs. time to market continues to be the biggest risk to organizations.
76% of USA and UK respondents have experienced an API security incident in the last 12 months.
Couchbase has published findings from industry research examining the challenges faced by development teams amid the race to the cloud and to execute on digital transformation initiatives.
Distology, the specialist IT cybersecurity distributor, is now a distribution partner of Jamf.
ConnectWise partners to benefit from an integrated payment processing platform built into ConnectWise Manage and now, ConnectWise Sell.
With tech costs top of mind, on average 38% of all software license expenditure goes wasted on unused or underutilized application licenses.
GitLab survey results show efficiency, higher quality code, and developer productivity are key drivers for DevOps adoption.
Knowledge silos, searching for answers and responding to queries from other team members, some of the major causes.