On the Effort for Security Maintenance of Open Source Components

@InProceedings{ dashevskyi.ea:foss-efforts:2018,
  author    = {Stanislav Dashevskyi and Achim D. Brucker and Fabio
               Massacci},
  title     = {On the Effort for Security Maintenance of Open Source
               Components},
  booktitle = {Workshop on the Economics of Information Security (WEIS)},
  location  = {Innsbruck, Austria},
  year      = {2018},
  areas     = {software, security},
  abstract  = {The work presented in this paper is motivated by the need to
               estimate the security effort of maintaining Free and Open
               Source Software (FOSS) components within the software supply
               chain of a large international software vendor. We
               investigated publicly available factors (from number of active
               users to commits, from code size to usage of popular
               programming languages, etc.) to identify which ones impact
               three potential effort models: centralized (the company checks
               each component and propagates changes to the product groups),
               distributed (each product group is in charge of evaluating and
               fixing its consumed FOSS components), and hybrid (seldom used
               components are checked individually by each development team,
               the rest is centralized). We use Grounded Theory to extract
               the factors from a six months study at the vendor. We report
               the results on a sample of 166 FOSS components used by the
               vendor.},
  keywords  = {Free and Open Source Software, Software Vulnerabilities,
               Security Maintenance},
  note      = {Author copy: \url{https://logicalhacking.com/publications/dashevskyi.ea-foss-efforts-2018/}},
  pdf       = {https://logicalhacking.com/publications/dashevskyi.ea-foss-efforts-2018/dashevskyi.ea-foss-efforts-2018.pdf},
}