Commercial Third Party Code Sources Pose Security Risks

Despite the fact that the use of third-party code in IoT projects has increased by 17 percent in the last five years, according to VDC Research, only 56 percent of OEMs have structured security testing policies. Meanwhile, 73.6 percent of respondents said protection was essential, very important, or critical to current projects when asked how important, very important, or critical it was. 

For years, the rate of required innovation outpaced the rate of resource growth within production and quality assurance organizations, making it difficult to keep up organically. With organizations no longer able to focus their code development strategy on custom code, using content from other sources has become more important. 

Because of the possible consequences for corporate harm, liability, and brand reputation loss, protection has become a pervasive and paramount concern in the software supply chain. 

“With more complex software supply chains becoming the norm, organizations are leaning on these third party assets to accelerate their internal software development, which creates security blind spots,” said Chris Rommel, EVP, IoT & Industrial Technology for VDC Research. “With standards such as IEC 62443 requiring increased security of IoT devices, new testing capabilities are needed to address these software creation changes to ensure code quality and minimize risk.” 

GrammaTech, a provider of application security testing tools, launched a new approach in 2020 aimed at exposing vulnerabilities in third-party code used in the production of custom applications. It was called CodeSentry, and it used binary software composition analysis (SCA) to create the code and find any bugs it might have. 

“Using third-party components, rather than building applications from scratch, is an accepted practice for accelerating time to market, and is fueling a massive growth in reusable code,” said Mike Dager, CEO of GrammaTech, in a statement. “Most organizations now recognize the security risks that third-party code poses to their applications and business, and the need for software composition analysis provided by CodeSentry, which inspects binaries for unmatched precision.”

“Commercial third party code, which is the fastest-growing component software within the IoT market, can contain both proprietary and open source components,” said Andy Meyer, CMO for GrammaTech.