Software composition analysis & the secret ingredients for a successful M&A

Open source is everywhere. Researchers have been tracking its growth for years, but because open source is now so pervasive, they are increasingly concerned about the security of applications built on the foundation of open source components. The only way an organization can be sure of the open source in its codebase, other than by meticulously tracking such use by hand, is by performing software composition analysis (SCA). 451 Research defines software composition analysis as “the identification of third-party, primarily open source, libraries that have been built into an application.” This identification capability helps organizations discover unpatched code, licensing issues, and potential security vulnerabilities that may be present in a codebase owing to open source use.

Why software composition analysis?

The simplest use case for SCA is an individual company monitoring and identifying its own use of open source components and frameworks. But in the latest study from 451 Research, they detail other use cases for SCA, the primary use case being in the mergers and acquisitions (M&A) space. As young companies bring new applications to market rapidly, they use increasingly more open source. So in M&A transactions, because management of open source is still relatively immature, the onus shifts to acquiring companies to be aware of the potential risks they may be inheriting along with the intellectual property in these codebases.

Getting a clear picture of open source in enterprise apps

Many statistics out there illustrate how much open source is in the typical software application. However, those stats can be misleading and often tell the wrong story. To get a clearer picture of open source growth for enterprise use, we should look at the percentage of open source in new applications. According to the 2018 Open Source Security and Risk Analysis (OSSRA) report, in more than 1,100 open source audits Black Duck by Synopsys conducted on commercial codebases last year, the average codebase was made up of 57% open source. That means that on average, more than half of each codebase we scanned was made up of open source components. It’s important to note that a key use case for a Black Duck Open Source Audit is M&A due diligence, meaning that the data in the OSSRA report is an excellent indicator of trends in open source in M&A transactions.

Faster delivery means more open source

As 451 Research states in its brief, the trend toward faster, more iterative delivery of applications is not going to abate anytime soon: “The use of open source components in those applications is no longer a novel idea. There is now a generation of developers for whom using code written by a third party, available at no-cost, is as intuitive as any other part of the development lifecycle, and is driven by the delivery demands placed on them.”

The concerns this trend creates in an M&A scenario are twofold: First, companies must understand what and how much open source is in the software they’re acquiring to assess the potential risk to their newly acquired intellectual property. And second, they must understand that risk profile ahead of the deal to protect the ROI of their investment and plan for any required remediation cost post-deal.

The Black Duck OSSRA report sheds light on the relative risk present in an average open source audit:

• 96% of the applications scanned contained open source, with an average of 257 components per application.
• 85% of codebases audited last year had either a license conflict or unknown license.
• 78% of the codebases contained at least one unpatched open source vulnerability, with an average of 64 known vulnerabilities per codebase.

Real costs of security breaches

To put it in the starkest of terms, imagine you were acquiring Equifax and did not perform open source diligence. As was highly publicized, the security breach—which compromised the personal data of more than 140 million people—was the result of an unpatched open source vulnerability in the Apache Struts framework. The breach itself has cost Equifax upward of $400 million so far, and the impact reaches far beyond the financial. Now, take one more leap with me: What if this happened in Europe under GDPR? Imagine the impact to the ROI of that acquisition.

What the Black Duck and 451 Research studies have revealed is that these two trends that are inextricably linked: The growth of open source is not slowing down anytime soon, so the stakes continue to get higher for M&A professionals to understand the full risk profile of the software they are acquiring.

Learn more about software composition analysis
Read the report: The Secrets Behind Open Source Audits for M&A