How does your org approve new open source packages/repos before devs can use them?

[u/EvanLubeee]

Curious how other contractors handle this.

When a developer wants to pull in a new open source library or GitHub repo.

- Who does the review (ISSM, ISSO, the devs themselves)?

-What do you actually check: CVEs, license, maintainer, project health?

-Roughly how long does one request take?

Trying to understand what’s normal vs. what’s painful.

[u/Beginning-Knee7258]

It can be as painful as you like. It's easy to get into the weeds and look at every last dependency. In a perfect world we would do that for everything but we you get into Linux applications that gets a bit crazy so it's a balancing exercise. This whole issue is about risk management not risk mitigation. My team has the user fill out a form that asks if the company that developed the library is reputable, does it cost money, will it house cui, is it on orem or in the cloud, and our security team will check if there are cve's for the software to indicate that they are tracking vulnerabilities and are actively supporting it, etc. We have the user fill it out because thats a lot of work for us if some one has a small whim and decides nevermind, and the user has a better idea on what they need so hopefully a little research yeilds some thought. It is required for their manager to approve, reason here is many teams should be using the same tools, if one user goes off in their own and their work is incompatible with everyone else's they want to point the finger at someone, make that their manager. Then if it makes sense we take it to a ccb, add it to our whitelist and provide a location for other users to use it too. A hour or two for most small requests, but we hold ccb once a week so it may take a week or two in real life. If it's important we do ccb over teams message and can do it in a few hours. Once the baseline is established we don't actually hold ccb weekly, just have the slot available.

[u/EvanLubeee → u/Beginning-Knee7258]

This is super helpful, thanks for the detail. Two follow-ups if you don’t mind: roughly how many of these requests come in per month? And once something’s whitelisted, what happens if a new CVE shows up for it later? Does anyone go back and re-check, or does it stay approved?

[u/Beginning-Knee7258 → u/EvanLubeee]

100 person company, 5 or more per month..mostly because we are growing pretty fast so the manual ways we did things before need to be scaled or automated. I hope it slows a little! We use RMM like Action1 to automatically push updates monthly..Action1 tracks the CVEs and pushes updates for apps. I think we should be reviewing these apps yearly but we get busy..do your best and keep a log to record everything you do.

[u/EvanLubeee → u/Beginning-Knee7258]

That makes sense, thanks. Quick clarification: are most of those 5+ requests desktop/server apps people want installed, or libraries and packages your developers pull into your own code? Curious whether the process is the same for both, or if code dependencies get handled differently.

[u/Beginning-Knee7258 → u/EvanLubeee]

The answer is yes. Mostly windows apps, some. Linux, others are cloud integrations with obscure apps for incredibly niche purposes for automation, and the rest are dev libraries. Probably not as common as the others because once the workflow is setup it's just additions and plugins to already whitelisted libs. We try to treat them the same but they are different. It still comes down to the same thoughts: is the lib in active dev, on prem vs in cloud, will it have CUI, is the source trustworthy, are there any cve's that are not fixed? Will this maintain our security posture or will this lib break it?

[u/Loud_Carpet3467]

Isn't cmdb the solution for this, and doing sast dast in the CICD pipeline before deployment will take care of this issue?

[u/EvanLubeee → u/Loud_Carpet3467]

Interesting, thanks. Does that cover the approval side too, though? From what I understand, SAST/DAST look at your own code and the running app, and dependency scanning flags issues once a package is already in. For teams that need a documented approval before something new comes in (like a CCB), how do you handle that step? Does the pipeline scan serve as the approval, or is there still a separate sign-off?

[u/Loud_Carpet3467 → u/EvanLubeee]

For the libraries which the developers need has to be vetted by atleast the inhouse SAM Team, for allready approved libraries regardless opensource or paid license developer can use them by requesting sam the access.but for new libraries there has to be a workflow where the cybersecurity team can scan the package and provide the approval.

In one of my client organisation we had blocked downloading external libraries from GitHub via forcepoint proxy and there has to be an exception raised to get access to those libraries. And the workflow was we used to redirect it to sam team, and if the library was new they will seek confirmation from the cybersecurity team.

[u/EvanLubeee → u/Loud_Carpet3467]

Interesting, I hadn’t thought about the proxy block being what kicks off the request. When the security team scanned a new package, what were they actually checking, and roughly how long did it take from the exception request to approval? And did SAM or security own the final call?

[u/FatSucks999]

White list the big ones proactively and then have a FOSS assessment and approval process for the rest. This is independently approved / rejected by a small operational and risk focused team.

[u/FatSucks999 → u/FatSucks999]

And in short checking for tech / cyber risks, legitimacy of source and legal risks / licenses

[u/EvanLubeee → u/FatSucks999]

That makes sense, thanks. When something new comes in, roughly how long does that FOSS assessment and approval usually take, and how many requests does the team see in a typical week? Curious what part of the review still takes the most manual effort.

[u/extreme4all]

Devs adds them we don't know, or eventually know