Addressing common development security mistakes

There are various ways that risks are introduced into modern software when they are developed. Modern software applications are for the most part a cocktail blend of proprietary code written by in-house developers and third-party components, which can originate from open source repositories, source-available code, or even commercially licensed code, which is less common but nonetheless exists (Figure 4.11):

Figure 4.11 – Modern software composition

Source-available software

Source-available software means that the source code of the software is publicly available for viewing. However, it doesn’t necessarily grant the same freedoms as open source software (OSS). While you can see the code, there may be restrictions on how you can use, modify, or distribute it. Think of it as a look but don’t touch approach to sharing software code.

Any of these components could introduce risks into...