Lineaje OSM improves software supply chain security

Lineaje unveiled Open-Source Manager (OSM), which brings transparency to open-source software components in applications and proactively manages and mitigates associated risks.

Lineaje’s OSM enables full lifecycle governance of open-source software with trust, speed, and reliability helping to build an overall stronger security posture for complex software development organizations.

Research indicates that open-source software has 10-times more risk than code created by internal developers and accounts for 95% of all risk in applications. Lineaje’s OSM unveils the hidden depths of open-source dependencies, tracing 20+ levels and pinpointing every package – down to the last level. It provides risk analysis for each component in that supply chain – including more vulnerabilities than any other tool.

OSM automatically attests every component for tamperability and integrity – making it unique in its ability to discover components of dubious origin in software as well as to detect tampers like 3CX, XZ, and SolarWinds.

“As organizations continue to embrace open-source to drive high innovation and to accelerate development cycles, our software supply chain is effectively open-sourced. Open-source developers are typically great innovators but not-so-great maintainers of software,” said Javed Hasan, CEO, Lineaje. “OSM is an automated open-source office in a box, extending an organization’s AppSec posture to open-source dependencies. It not only separates well-maintained and unmaintained open-source components but enables proactive mitigation of embedded open-source risks.”

OSM goes beyond discovery by introducing an innovative “plan & fix” module. Not all patches or vulnerability fixes are equally compatible or applied at the same dependency depth. Lineaje AI with BOMbots generates plans in minutes for open-source patching so that developers can apply all compatible and all incompatible patches in batches.

This reduces mean time to protect (MTTP) and saves up to 40% in software maintenance efforts. Unmaintained components with unfixed vulnerabilities and policy violations can be routed to inner or out-sourced teams chartered to maintain risky open-source dependencies.

“As developers increasingly leverage open-source code to save time and increase their productivity and innovation, organizations need robust security measures because attackers often target vulnerabilities in commonly used open-source packages,” said Melinda Marks, Practice Director, Cybersecurity, Enterprise Strategy Group. “Lineaje’s Open-Source Manager will help organizations safely leverage open-source by identifying potential risks and remediating vulnerabilities, while also facilitating compliance with governance regulations.”

The OSM solution enables companies to:

• Simplify discovery and search comprehensively: Find and search all direct open-source dependencies down to the deepest level and discover the impact of vulnerabilities and risks.
• Analyze inherent risk: Automatically examine each component and application for risks–vulnerabilities, licenses, code quality, security posture, maintainability, age, supplier, provenance and more.
• Monitor tamperability and integrity levels: Sophisticated fingerprinting identifies components that have suspicious and unknown origins.
• Establish governance: Use consistent criteria for selecting, upgrading and fixing open-source components, and create rules for each. Auto-detect components violating policy using Lineaje’s Findings engine.
• Optimize planning and fix: Lineaje AI, using BOMbots, builds SMART “what if” plans in minutes. These SMART plans reduce maintenance efforts by up to 40%.
• Fix unmaintained open-source: 95% of all vulnerabilities come from open-source; 56% of them are left unresolved. Unmaintained open-source components identified by OSM are routed to the inner or outer sourced development teams with detailed remediation instructions.
• Integrated search: Search all dependencies in seconds for vulnerabilities, licenses, provenance, supplier details and more across all supply chain trees, enhancing operational efficiency.

“With the proliferation of open-source components in all applications, directly managing open-source dependencies has become paramount. Lineaje’s Open-Source Manager enables not only discovery but also planning and remediation of vulnerabilities,” said Ashok Banerjee, SVP, Product Engineering, Trellix. “Supply Chain Security is an essential tool for the modern software factory.”

“Persistent is proud to work with Lineaje to deliver the most comprehensive open-source maintenance service across diverse industries. The Persistent Open Source Hub embeds Lineaje’s Open-Source Manager (OSM) for proactive risk identification and automated mitigation enabling us to protect clients’ critical software,” said Nitish Shrivastava, SVP and Head of Products, Persistent.

“This empowers us to provide trusted open-source components with fixes for issues not yet made available in the open-source community, boosting clients using Persistent’s open-source crew service. This boosts operational efficiency while swiftly ensuring compliance with governance standards. OSM has quickly become an indispensable part of our open-source service,” added Shrivastava.