I. Introduction

With the rapid advancement of software development technologies, modern application systems are no longer developed from scratch, and open source software (OSS) has been widely used in application systems and software development. By utilizing existing open source software packages, organizations can not only shorten development cycles and reduce development costs, but also quickly adopt mature technologies. However, the accompanying known security vulnerabilities and license-related disputes have become core threats to the software supply chain. In the past, reliance on manual review made it difficult to gain visibility into the deep dependencies of open source software packages, which could easily create cybersecurity blind spots.

To specifically address the above issues, TDCC introduced an open source software analysis tool and established an open source software management process. This can integrate the security and compliance of open source software package usage into every stage from application system development to operation and maintenance. II. Architecture, Application, and Benefits of the Open Source Software Analysis Tool

(I) Tool Architecture

TDCC's open source software analysis tool mainly uses a centralized platform to identify and inventory the open source software packages used by each system and analyze their associated risks. It integrates TDCC's in-house open source software package repository and software development as well as deployment processes. It analyzes information such as component names, versions, and dependencies, and further checks for known cybersecurity vulnerabilities and reviews open source license terms.

With bill of materials and risk data established, developers can keep track of the open source software packages used in their systems and classify risks by vulnerability severity, license type, and corporate management policies. This serves as a basis for subsequent patching, upgrading, replacement, or risk acceptance.

(II) Applications and Benefits of Implementation

(1) Integration into the Secure Software Development Life Cycle (SSDLC), from Development to Deployment

The open source software analysis tool has been integrated into TDCC's Secure Software Development Life Cycle (SSDLC), covering stages from development to production deployment. Through the package repository and automated scanning mechanisms, it helps developers obtain and use vetted open source software packages, and checks component versions, dependencies, and known cybersecurity vulnerabilities during the development and build processes. Packages that show malicious characteristics or violate security policy rules classified as high-risk can be automatically quarantined or blocked in accordance with management rules. Before production deployment, further security and license checks are performed to ensure that the open source software in use complies with TDCC's security and compliance requirements. This can reduce the likelihood of high-risk or non-compliant packages entering the production environment.

(2) Security and Compliance Review

The platform can continuously track security and license information on open source software packages. When new cybersecurity vulnerabilities are disclosed, it can quickly identify the affected components, versions, and systems using them so as to facilitate patching, upgrading, or replacement. At the same time, through license term analysis, it can help developers identify the usage and distribution requirements associated with different open source licenses, reduce the legal and compliance risks resulting from license non-compliance, and strengthen the security and traceability of the software supply chain.

(3) Management Benefits

After implementation, the open source software packages used in development can be centrally managed, security and license reviews can be carried out, and SBOM (Software Bill of Materials) reports can be generated. By consolidating the open source software components, versions, and dependencies used by each system and by combining them with vulnerability, license, and risk information, TDCC can quickly gain a clear view of the open source software composition and usage of each system. This can serve as a basis for subsequent vulnerability patching, version upgrades, and risk treatment. The implementation has effectively reduced the burden of manual inventory and inspection. It has also improved the visibility of open source software assets as well as the efficiency of identifying and handling security and license risks.

III. Conclusion

The open source software analysis tool is not only a vulnerability scanning tool, but also an important foundation for TDCC's software supply chain security and open source software management. By combining the tool with management policies and development processes, TDCC can benefit from the speed, flexibility, and low cost of open source software while effectively reducing cybersecurity, licensing, and supply chain risks. .jpg ".auto")