Building open source security into agile application builds
Abstract
Open source software offers many benefits, not least of which is the way that readily available software components and libraries can speed development. By not having to constantly reinvent the wheel, developers are able to adopt agile development methods that are adaptive, responsive – and fast. But there's also a risk involved. Using open source software offers many benefits and can speed development. But there are risks involved. Changes to applications are being made so quickly and so often that it is difficult to understand and review them for risk. And application development and security practices often appear to be at odds. To employ open source components safely, organisations need visibility into which components they're using. Tim Mackey of Black Duck by Synopsys examines how DevOps teams can utilise automated software composition analysis (SCA).
Integrity signals
Registry
Cites
Statistics
Claims the paper makes
Claims other papers make about this one
Each is checked against this paper’s own text: does it say what the citing paper says it does?
Inter-rater reliability for mapping showed significant agreement between external experts and study authors (W = 0.635, p = 0.0005).
“After comparing both outcomes we have calculated the Kendalls coefficient of concordance (W = 0.635, p = 0.0005) shows the significance agreement between both results.”
From Prioritization based taxonomy of DevOps security challenges using PROMETHEE (2020) · cites this paper as [68]
Inter-rater reliability for data extraction showed significant agreement between external experts and study authors (W = 0.84, p = 0.003).
“The results of W = 0.84, (p = 0.003) show the significance agreement between the external experts and study authors.”
From Prioritization based taxonomy of DevOps security challenges using PROMETHEE (2020) · cites this paper as [68]
Cites
Jim Bird ‘2017 State of Application Security: Balancing Speed and Risk’; Oct 2017: SANS Institute> www.sans.org/reading-room/whitepapers/application/2017-state-application-security-balancing-speed-risk-38100 accessed April 2018
(n.d.)
Unresolved‘W Edwards Deming’. Wikipedia; https://en.wikipedia.org/wiki/W._Edwards_Deming accessed April 2018
(n.d.)
Unresolved
Flagged first, then by citations
2 of the 2 references couldn’t be matched to a known paper.
Cited by
Sorted by citations
An Empirical Study on Software Bill of Materials: Where We Stand and the Road Ahead
Xia, B., Bi, T., Xing, Z., Lu, Q., & Zhu, L. (2023) · ACM/IEEE International Conference on Software Engineering: Companion Proceedings (ICSE-Companion) · doi:10.1109/icse48619.2023.00219 · Cited by 101 · see citing works
“[42] explored integrating automated SCA into DevOps processes.”
MethodKumar, R., & Goyal, R. (2020) · Computers & Security · doi:10.1016/j.cose.2020.101967 · Cited by 97 · see citing works
Prioritization based taxonomy of DevOps security challenges using PROMETHEE
Rafi, S., Yu, W., Akbar, M. A., Alsanad, A., & Gumaei, A. (2020) · IEEE Access · doi:10.1109/access.2020.2998819 · Cited by 50 · see citing works
“We reviewed those studies briefly and extracted all the challenging factors including lack of secure coding standards [2], [23], [80], [81], using unsuitable performance metrics for security evaluation [2], [69], [78], [79] and lack of integrated testing tools to secure DevOps [14], [52], [53], [71].”
BackgroundMethodIntegrating Security into CI/CD Pipelines: A DevSecOps Approach with SAST, DAST, and SCA Tools
Koneru, N. M. K. (2021) · International Journal of Science and Research Archive · doi:10.30574/ijsra.2021.3.1.0080 · Cited by 44 · see citing works
On the Way to SBOMs: Investigating Design Issues and Solutions in Practice
Bi, T., Xia, B., Xing, Z., Lu, Q., & Zhu, L. (2024) · ACM Transactions on Software Engineering and Methodology · doi:10.1145/3654442 · Cited by 31 · see citing works
Teixeira, D., Pereira, R., Henriques, T. A., da Silva, M. M., Jo�ã, N. A., Faustino, J., & da Silva, M. M. (2020) · International Journal of Agile Systems and Management · doi:10.1504/ijasm.2020.112343 · Cited by 27 · see citing works
Barclay, I., Taylor, H., Preece, A. D., Taylor, I., Verma, D. C., & de Mel, G. R. (2020) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.6129 · Cited by 20 · see citing works
“In such a way, outdated sub-components of the system can be readily identified, which is particularly important when vulnerabilities have been found and fixed in updated versions of the module 38 .”
BackgroundA Systematic Literature Review on DevOps Capabilities and Areas
Teixeira, D., Pereira, R., Henriques, T. A., da Silva, M. M., & Faustino, J. (2020) · International Journal of Human Capital and Information Technology Professionals · doi:10.4018/ijhcitp.2020040101 · Cited by 22 · see citing works
Barclay, I., Preece, A. D., Taylor, I., Radha, S. K., & Nabrzyski, J. (2022) · Concurrency and Computation Practice and Experience · doi:10.1002/cpe.6997 · Cited by 18 · see citing works
A Systematic Literature Review on DevOps Capabilities and Areas
Teixeira, D., Pereira, R., Henriques, T. A., da Silva, M. M., & Faustino, J. (2020) · International Journal of Human Capital and Information Technology Professionals · doi:10.4018/ijhcitp.2020070101 · Cited by 16 · see citing works
Trends for the DevOps Security. A Systematic Literature Review
Leppänen, T., Honkaranta, A., & Costin, A. (2022) · Lecture notes in business information processing · doi:10.1007/978-3-031-11510-3_12 · Cited by 13 · see citing works
Assessing source code vulnerabilities in a cloud‐based system for health systems: OpenNCP
Larrucea, X., Santamaría, I., & Colomo‐Palacios, R. (2019) · IET Software · doi:10.1049/iet-sen.2018.5294 · Cited by 13 · see citing works
“In the healthcare sector, special attention is dedicated to data security [8], and therefore more security checks are recommended if we use open source software [9, 10].”
MethodBuilding Software Applications Securely with DevSecOps: A Socio-Technical Perspective
Naidoo, R., & Möller, N. (2022) · European Conference on Cyber Warfare and Security · doi:10.34190/eccws.21.1.295 · Cited by 11 · see citing works
Byrne, A., Nadgowda, S. J., & Coskun, A. K. (2020) · International Workshop on Serverless Computing (WoSC) · doi:10.1145/3429880.3430098 · Cited by 6 · see citing works
“, accidental use of an outdated library) and have become attractive targets for bad actors looking to quietly insert backdoors, sabotage tools, and even cryptocurrency miners into otherwise-legitimate cloud software via third-party libraries or compromised compilers [2, 14, 17].”
BackgroundOpen-Source Software Security Challenges and Policies for Cloud Enterprises
Gupta, S., & Vadlamudi, S. (2023) · International Conference on Intelligent Communication and Computational Techniques (ICCT) · doi:10.1109/icct56969.2023.10076194 · Cited by 4 · see citing works
“In his work, Tim Mackey [6] 2018 highlights the benefits of using open source and mentions that it acts as a catalyst for development as you have available features ready to use during development lifecycles.”
BackgroundHu, J., Zhao, Z., Hang, F., et al. (2024) · Applied Mathematics and Nonlinear Sciences · doi:10.2478/amns-2024-0040 · Cited by 1 · see citing works
DevSecOps: Enabling Security by Design in Rapid Software Development
Ahmed, A. (2019) · Utrecht University Repository (Utrecht University) · Cited by 1 · see citing works
Wang, Y., Tajudeen, F. P., Norman, A. A., & Shuib, L. M. (2026) · Research Square · doi:10.21203/rs.3.rs-8486223/v1
- Authors
- Mackey, T.
- Affiliations
- Black Duck by Synopsys
- Corresponding author
- Mackey, Tim
- ORCID
- Mackey, Tim
- Venue
- Network Security
- Publisher
- Breda Publishing Press
- Published
- 2018-04
- Volume
- 2018
- Issue
- 4
- Pages
- 5-8
- ISSN
- 1353-4858 (ISSN-L)
- 1872-9371
- OpenAlex
- W2802653165
- Cited by
- 18
- References
- 2
- Citations by year
- 2026: 1 · 2024: 2 · 2023: 2 · 2022: 3 · 2021: 1 · 2020: 7 · 2019: 2
- FWCI
- 4.03
- Type
- journal article
- Language
- en
- Open access
- closed
- Locations
- Network Security (publishedVersion)
- Topics
- Physical Sciences › Computer Science › Information Systems › Web Application Security Vulnerabilities
- Physical Sciences › Computer Science › Information Systems › Software Engineering Techniques and Practices
- Physical Sciences › Computer Science › Information Systems › Information and Cyber Security
- Keywords
- open source software, software security, agile software development, DevOps, software composition analysis, automated vulnerability detection
About these checks
Registry, retraction, Cites and statistics results are computed, not judged, with one exception: a printed reference that no index lists is read once by a model before it counts as a citation error. Claims are extracted by a model and kept only when their quote appears verbatim in the text; each cited source is then checked, with a model’s help, for whether it says what the claim relies on. Those verdicts can be wrong — read the claim’s quote and the cited source before relying on one.
Statistics and arithmetic are recomputed, not judged.
Confidence bands are shown only for fields calibrated on our annotated test set. None is calibrated yet, so no band is shown.
What counts as a claim ›How we measure confidence ›How we check this ›
Are you an author, or do you see a problem with this page? Request a review
