Balancing Risk and Innovation

Understanding the impact of open source software on regulatory compliance

Contents

How open source has revolutionized software development
The Rise of Node.js
Security, Compliance, and The Dark Side of Open Source
The Regulation Boogeymen
The Winning Combination: How to Prioritize both Security and Innovation
Understanding Risk with NodeSource Certified Modules
Why choose Certified Modules?
Here’s what you get from NCM
Contact us

This white paper provides guidance for organizations subject to common regulatory frameworks, such as HIPAA and GDPR. It explains the advantages of adopting open source technology and provides guidance on associated cybersecurity and compliance considerations.

It’s no stretch to say that in the past thirty years technology has transformed everything about how we work and live. So much so that tech companies now find themselves torn between two equally important but competing priorities. On the one hand, in order to stay afloat in a cutthroat industry, software developers are pushed to release more frequently, improve overall quality, and accelerate innovation. On the other hand, as cybersecurity threats and privacy regulations intensify, IT organizations are being tasked with creating controls to minimize risk and automate compliance.

How open source has revolutionized software development

This dichotomy is clear in the adoption of open source software (OSS) by enterprise organizations. In recent years, the adoption of OSS has been explosive, and it’s not hard to see why. Why invest time and money to build something someone else has already built and agreed to share with you for free? The result is exactly what you would expect. In 2016 alone developers downloaded 52 billion Java components and 59 billion JavaScript components from open source repositories.¹

Open source is so popular that 98 percent of developers report using open source tools – even against management directives.² Meanwhile companies like Twitter, Netflix, and Ericsson are paying developers to participate in the open source community, and to develop and use open source in their own frameworks. According to Forrester, more than 76% of developers are currently using open source technology.³ This is a clear sign that OSS has taken its rightful place at the center of the development of new, innovative technologies.

1 2017 State of the Software Supply Chain Report

2 Why more companies are adopting open source technology

3 4 reasons companies say yes to open source

That’s a good thing. When OSS is integrated into an organization’s development process, software evolves more quickly, while bugs and vulnerabilities are detected and fixed by a whole community of open source contributors, rather than by a single, isolated department or team. This results in shorter wait times for patches and new version releases, reduces development spending, and increases developer satisfaction.

The Rise of Node.js

Node.js rose to popularity as the result of multiple convergent factors. First, companies are under pressure to quickly build web applications that are fast, scalable, and distributed. Second, large organizations recognize the massive risk associated with huge, complex applications because it’s so difficult and expensive to tune, maintain, patch, and debug these monoliths. Finally, software developers are increasingly responding to the new market realities of agile practices, continuous integration and delivery, cloud-scale application design, and a highly-mobile and demanding user base.

Node.js serves all of these needs with a module-driven and highly-scalable approach to application design, development, and deployment that enables development teams to put the most desirable elements of agile methodology into practice. This reduces risk and increases developer productivity, with the serendipitous side effect that it raises developer morale in the process.

Node.js was born in 2009, when Google engineer Ryan Dahl had a brilliant idea: “Google Chrome is a great web browser mostly because of the V8 engine, but what if I move V8 to the server side and execute JavaScript on the server?” So, Ryan took V8 to the server, built a small layer around it to manage the runtime capabilities of JavaScript on the server, and called it Node.js.

When Dahl presented his new technology at the JSConf in 2009, he got a standing ovation. In the years since, Node.js and its ecosystem have acquired more than 6 million monthly users with 100 percent year-over year growth. Here are a few reasons why:

The Node runtime works on embedded systems, all standard variants of Linux and Unix, Windows servers and desktops, and Mac OS X. This means you can pick up your software, and as long as you're careful not to write anything specific to the file system or structure that you're expecting there, you can basically run it anywhere. This is a huge benefit for portability and not having to write new code or implement new libraries.
Thanks in part to its widespread popularity, Node.js has an extensive ecosystem of open source add-on components. This makes for an impressive list of different modules that allow you to perform a variety of actions, interact with different systems, or perform common operations using Node.js. Again, this is one of the many benefits of having a large developer community in which many people contribute code.
Another reason that Node.js is so popular is its very small footprint. This makes it possible to embed the Node.js runtime on low-power devices used for Internet of Things (IoT) apps, like a web-enabled home thermostat or garage door opener. It's lightweight enough to run on small, inexpensive hardware, so much so that hobbyists regularly use Node.js on a Raspberry Pi or Arduino board to automate small tasks.
Large enterprises tend to have internal organizational or technological silos that can result in narrowly-specialized institutional knowledge within specific projects, presenting an unnecessary business risk. These barriers need to be removed so that engineering knowledge and personnel can cross between business units and within internal business units. The module-driven nature of Node.js encourages the creation of small teams of developers to solve atomic problems of functionality; this self-contained code can then be put to use by other teams. This encourages greater interaction and cooperation between developers, which in turn leads to increased productivity. As an example, PayPal was able to double developer productivity using Node.js, meaning it took half the number of developers to deliver an application in less time when compared to Java10.
Node.js is excellent for quick iteration. Programs can be inspected and errors can be addressed on-the-fly, and developers can publish small changes constantly without restarting the application for each deploy. Modular blocks of code can be reused, allowing development teams to focus on solving new problems instead of reinventing the wheel. And because Node.js uses JavaScript, applications don’t require independent front-end and back-end teams; any single developer or small team familiar with JavaScript can build a working prototype.

When the team at CapitalOne undertook a major transition to public cloud infastructure, Node.js quicky emerged as the ideal technology to use as an orchestration type.

Read the full case study: After Call for Innovation from C-suite, Node.js Pops Up All Over Capital One

As teams at Uber took on the challenge of delivering a consistent experience during a period of massive growth, the ability to make updates or fixes to a running process was key. Developers could inspect behavior, deploy changes, and even fix errors generated by these changes, even in a production environment, because there was no need to stop or restart a running process along the way. This in turn established a culture in which problems are solved as they come up, and developers are empowered to publish incremental changes and improvements more frequently.

Because of these myriad advantages, many enterprise companies are giving Node.js a larger role in their development strategy. A few examples include:

By shifting its user interfaces to Node.js, Netflix has been able to streamline development, cut the build times, and increase the level of customization of its UIs for each user.⁴
PayPal initially adopted Node.js as a platform for prototyping and proofs of concept; it proved so effective that it was later introduced into production systems. Today, PayPal uses Node.js to seamlessly manage over 200 million active user accounts worldwide.⁵
When Uber needed their system to be reliable to a rapidly-growing base of both customers and drivers, they chose node.js because of its processing power, error analysis, and constant technology improvement from the open source community. Uber is now able to process over 2 million remote procedure calls (RPC) per 1 second, even at peak usage times.⁶

4 How Node.js Powers the Many User Interfaces of Netflix

5 Node.js at PayPal

6 How Uber Uses Node.js to Scale Their Business

Security, Compliance, and The Dark Side of Open Source

While OSS opens up numerous possibilities for improving development efficiency, it can also open up a company to increased security risks if data security isn’t built into all development processes by design. The issue is that many organizations don’t pay enough attention to the security exposures created by vulnerable open source components, and may not even be aware these exposures exist. According to recent research by Flexera, 39 percent of the 400 software suppliers, Internet of Things manufacturers, and in-house development teams surveyed said said that either no one within their company is responsible for open source compliance or that they don’t know who is responsible for it.⁷

“Reducing open source risk can only happen if software suppliers have policies in place and enforce them,” report authors concluded. “They have to communicate these policies to all the development teams that are writing code and incorporating open source components into that code.”⁸

Compounding this issue is the fact that while Node.js developers (84%) felt very confident in the security of core Node.js, just 16 percent were confident that the third-party packages they used were free from vulnerabilities. This helps to explain why 60 percent of developers aren’t confident in the security of their applications according to new research from NodeSource and Sqreen⁹. And given the sheer number of third-party packages in use today, many organizations struggle even to know which modules their developers are using.

7 Companies overlook risks in open source software

8 Companies overlook risks in open source software

9 The State of Node.js Security in 2017

All of this adds up to the fact that more than 50 percent of the Global 500 use vulnerable open-source components.¹⁰ Verizon research shows that “Most attacks exploit known vulnerabilities [in open source components] that have never been patched despite patches being available for months, or even years.”¹¹ For example, in the case of the recent Equifax data breach, hackers were able to exploit the fact that a months-old open source patch was never implemented, despite being flagged as top priority by experts.

Google’s Information Security Manager Heather Adkins described the struggle this way: “I think it’s the cost of doing business with open source software. The reality is that we have to stay on top of it. Even if you’re just two people in a garage, one of you needs to be in charge of security, whether it’s part-time as an IT person or as a lead software developer.”¹²

But although the developer community understands the risks of operating in the open internet and the complexities of building reliable, secure code, these same developers are not taking advantage of tools that can identify and mitigate threats.

Surprisingly, the survey from NodeSource and Sqreen revealed that fewer than a third of developers combine manual and automatic code reviews to search for flaws or use automated tools to discover vulnerable modules. And a full 40 percent don’t check if there are known vulnerabilities in their third-party dependencies at all, creating an easily-exploited attack vector.¹³

"Our survey results clearly demonstrate that security is a concern for developers — but not a priority"Joe McCann, CEO of NodeSource

10 More than 50% of Global 500 use vulnerable open source components

11 Verizon’s 2016 Data Breach Investigations Report finds cybercriminals are exploiting human nature

12 Google’s Heather Adkins thinks everybody is going to get hacked and you need to be ready

13 Fewer Than a Quarter of Node.js Developers Use Any Form of Real-Time Protection Against Attacks

The Regulation Boogeymen

The pressure to focus on cybersecurity has only intensified as increasingly strict regulatory standards are adopted around the world.

Case in point: the General Data Protection Regulation, or GDPR (Regulation EU 2016/679 of the European Parliament and of Council of 27 April 2016) is a regulation the European Union introduced to improve and unify personal data protection of individuals. It enters into application in May 2018. Although this is an EU regulation, it applies not only to EU-based companies but also to those outside the EU:¹⁴ “rules must apply if personal data is handled abroad by companies that are active in the EU market and offer their services to EU citizens.”¹⁵

Apart from written warnings and regular audits, “administrative fines up to 20,000,000 EUR, or in the case of an undertaking, up to 4% of the total worldwide annual turnover of the preceding financial year” are subject of sanctions (Article 83). A fine of that magnitude could easily put many companies out of business. Moreover, the details and analysis of any data breach must be reported to the Supervisory Authority within only 72 hours of the breach being discovered (Article 33).¹⁶

Another law that puts cybersecurity on the front burner is HIPAA, (Health Insurance Portability and Accountability Act of 1996) a piece of US legislation that provides data privacy and security provisions for safeguarding medical information. HIPAA says, “a covered entity must conduct an accurate and thorough assessment of the potential risks and vulnerabilities to the confidentiality, integrity, and availability of electronic protected health information held by the covered entity.”

But if new HealthTech companies are using a codebase that is over 50% open source, and they rely only on penetration testing and network security scanners to detect vulnerabilities, they are failing to “conducting an accurate and thorough assessment […] of the potential risks and vulnerabilities…” In fact, these tools do not even have rules for many of the known vulnerabilities in open source code. OSS can help healthcare organizations remain flexible as they adopt new IT solutions, but if teams lack open source security measures it can lead to larger cybersecurity issues.

14 GDPR EU Compliance – an Opportunity for Enterprise Architects?

15 Commission proposes a comprehensive reform of data protection rules to increase users' control of their data and to cut costs for businesses

16 GDPR EU Compliance – an Opportunity for Enterprise Architects?

The Winning Combination: How to Prioritize both Security and Innovation

Achieving the right balance between security and innovation is impossible if you don’t build security procedures into your processes by design. For example, operations teams need to become comfortable with regularly updating their deployed version of Node.js in production. To accomplish this, security and operations teams should stay on top of release announcements for Node.js. The Common Vulnerabilities and Exposures (CVE) system will have information on any security vulnerabilities identified in Node.js itself, as well as reporting issues that arise within the larger Node.js ecosystem. And the Node Security Project should be utilized as a resource for ongoing Node ecosystem vulnerability announcements, which should be cross-referenced with code in production.

While it is common for new technologies to be treated as second-class citizens while the organization catches up, security cannot be allowed to lag behind. Security teams should treat Node.js platform vulnerabilities in the same way as vulnerabilities reported for the JVM, the CLR or RHEL, even if Node.js is not exposed directly to the internet.

Last but not least, it’s a good idea to develop a solid smoke test suite or plan to sanity-check upgrades to components of Node.js deployments. Operations teams should have a means to perform basic validation of the success of upgrades in order to gain confidence in deploying and upgrading an evolutionary platform like Node.js.

Understanding Risk with NodeSource Certified Modules

The Node.js ecosystem is home to nearly half a million modules, but not all of these are secure, well-maintained, or up to date. Yet organizations rely upon untrusted third-party Node modules to run mission-critical applications and services.

For this reason, NodeSource Certified Modules (NCM) was developed. NCM is a secure, private registry of trusted Node.js modules. NCM calculates a trust score for each public third-party module, monitoring for security vulnerabilities and dynamically adjusting scores in real time to identify emerging risks. Armed with an understanding of a module’s risk profile, users can confidently install third-party modules in mission-critical environments.

Why choose Certified Modules?

Take advantage of the massive ecosystem of open source resources available for Node.js and accelerate innovation.
Ensure compliance and minimize liability without excessive process overhead for development teams, enabling faster development and deployment cycles.
A “trust score” and a detailed breakdown for each module allows your organization to benefit from third-party code with a quantitative understanding of risk.
Keep data and services secure with ongoing vulnerability scanning that identifies emerging

Here’s what you get from NCM

Security. We check for the presence of known security vulnerabilities across all modules so you can ensure your applications only contain packages free of known security vulnerabilities or unverifiable code.
Integrity. We ensure integrity of the package files and code by verifying the packages have adequate documentation and adhere to OSS standards.
Reliability. As a Certified Modules customer, you get access to a highly reliable hosted registry so registry downtimes are a thing of the past.
Support. Node.js has long term support and now, so do your modules. Certified Modules are compatible with Node LTS and are monitored continuously to identify risk over time.
Convenience. Using Certified Modules involves making a simple configuration change that requires no modification to your existing code and workflows.
Collaboration. Add new members to a shared team, manage seat assignment, and assign package whitelisting privileges to team members.

A convenient web interface enables review of the trust scores of all packages in the registry at any point. A simple configuration change is all that is required to start using your secure registry. As a user, you continue to use your existing workflows to build your Node.js applications without any modifications.

For our customers’ convenience, we also provide a command-line interface that allows customers to whitelist one or more packages to exclude them from the certification process until they can be refactored and/or replaced.

“Node.js is revolutionizing development for enterprises, but there is a lot of work to do to ensure the ecosystem remains secure,” said Jean-Baptiste Aviat, Co-Founder and CTO of Sqreen. “Developers have a wide array of security tools at their disposal that they are simply not using. We have more work to do evangelizing the importance of security tools for the health of the Node.js ecosystem.”

It’s clear that the tension between innovation and risk management isn’t going anywhere. But by taking advantage of the latest technologies, it’s in no way impossible to prioritize both at once.

Contact us

Trusted By