A joint report released June 26 by the Cybersecurity and Infrastructure Security Agency, FBI, the Australian Cyber Security Centre and Canadian Centre for Cybersecurity provides roadmaps for addressing memory safety vulnerabilities in open source software. The agencies explored a set of critical open source projects to determine the extent to which they were written in memory-unsafe languages and found that 52% of them had coding written in a memory-unsafe language, among other findings. The agencies determined that most critical open source projects analyzed, even those written in memory-safe languages, potentially contain memory safety vulnerabilities.  
  
“This report highlights the cyber risk of using potentially vulnerable open source code for internal coding projects or cyber risk exposure through third-party technology providers which may leverage open source code,” said John Riggi, AHA national advisor for cybersecurity and risk. “Useful recommendations include targeted rewrites of critical components in memory-safe languages and insisting that third-party software developers reduce this risk by implementing ‘secure by design, secure by default principles,’ which we as a sector can drive by including ‘security by demand’ in our software purchase requirements.” 
 
For more information on this or other cyber and risk issues contact Riggi at jriggi@aha.org. For the latest cyber and risk threat information and resources visit www.aha.org/cybersecurity

Related News Articles

Headline
A non-malicious global technology outage that began in the early morning of July 19 is continuing to affect many industries and is having varying effects on…
Headline
John Riggi, AHA’s national advisor for cybersecurity and risk, participated July 18 as the opening keynote speaker in the Information Security Media Group’s…
Headline
A joint advisory issued the week of July 8 by the Cybersecurity and Infrastructure Security Agency, National Security Agency, FBI and several international…
Headline
The AHA July 2 submitted comments to the Cybersecurity and Infrastructure Security Agency on its proposed rule establishing reporting requirements for…
Headline
The Department of Health and Human Services Health Sector Cybersecurity Coordination Center June 27 issued an alert about a critical vulnerability in MOVEit, a…
Headline
The Health Information Sharing and Analysis Center June 27 issued a threat bulletin alerting the health sector to active cyberthreats exploiting TeamViewer. H-…