A joint report released June 26 by the Cybersecurity and Infrastructure Security Agency, FBI, the Australian Cyber Security Centre and Canadian Centre for Cybersecurity provides roadmaps for addressing memory safety vulnerabilities in open source software. The agencies explored a set of critical open source projects to determine the extent to which they were written in memory-unsafe languages and found that 52% of them had coding written in a memory-unsafe language, among other findings. The agencies determined that most critical open source projects analyzed, even those written in memory-safe languages, potentially contain memory safety vulnerabilities.  
  
“This report highlights the cyber risk of using potentially vulnerable open source code for internal coding projects or cyber risk exposure through third-party technology providers which may leverage open source code,” said John Riggi, AHA national advisor for cybersecurity and risk. “Useful recommendations include targeted rewrites of critical components in memory-safe languages and insisting that third-party software developers reduce this risk by implementing ‘secure by design, secure by default principles,’ which we as a sector can drive by including ‘security by demand’ in our software purchase requirements.” 
 
For more information on this or other cyber and risk issues contact Riggi at jriggi@aha.org. For the latest cyber and risk threat information and resources visit www.aha.org/cybersecurity

Related News Articles

Headline
Microsoft July 19 issued an alert about active attacks from vulnerabilities targeting SharePoint servers used within organizations. The incidents have not…
Headline
In his latest AHA Cyber and Risk Intel blog, Scott Gee, AHA deputy national advisor for cybersecurity and risk, explains how hospitals can prepare for and…
AHA Cyber Intel
In today’s heightened threat environment, driven by domestic and geopolitical issues, it is more critical than ever for hospitals to prepare for and mitigate…
Headline
In a statement submitted to the Senate Health, Education, Labor and Pensions Committee for a hearing today on health care cybersecurity and patient privacy,…
Headline
Cyberattacks on hospitals are urgent threats to patient safety, care delivery and public trust. In this conversation, Ajay Gupta, board chair of Trinity Health…
Headline
The Food and Drug Administration yesterday released a safety notice announcing a software patch is available to address cybersecurity vulnerabilities in…