Financial Services Industry Proposes Security Controls For Third-Party, Open-Source Software

The financial services industry has come up with a proposed strategy for deploying third-party software -- including open-source -- and services securely in financial institutions.

Members of a working group of the FS-ISAC (Financial Services Information Sharing and Analysis Center) this week proposed three basic security controls for ensuring the security of third-party software used by financial services firms: a vendor-focused Building Security In Maturity Model (BSIMM) assessment, binary static analysis, and policy management for open-source software libraries and components.

"What we're doing here is adding some controls that are based on knowledge [larger financial institutions] have obtained in software security maturity ... and adding those to third-party software governance," says Jim Routh, CISO at Aetna, and a member of the FS-ISAC Product & Services Committee who worked on the proposed controls.

The growing threats to Web-based applications and emerging mobile apps were factors in the development of the software security requirements for third-party software used in the financial services industry, he says. And vulnerabilities and weaknesses in third-party software and open-source software have increasingly become a concern for enterprises adopting those elements into their applications and systems.

"Software security controls are an integral part of building high quality software," the FS-ISAC's "Appropriate Software Security Control Types for Third Party Service and Product Providers" whitepaper says. A working group made up of executives from Fidelity, Morgan Stanley, Goldman Sachs, Capital One, Thomson Reuters, and Citi worked on the controls.

[While there is certainly room for improvement, the software vendor and financial services communities are making a steadily improving progression in maturing their software security practices. See Software Security Maturity Plods Along .].

Aetna's Routh says the Vendor BSIMM, vBSIMM, is basically a subset of BSIMM, a study of actual secure software development programs at companies so other companies can measure their efforts with their counterparts. vBSIMM is a way to measure the maturity of software security of vendors selling to the financial industry. "This is a better indicator of risk," Routh says.

Scanning binary code in software provides a vulnerability density score for a particular version of software at a specific point in time, Routh says. So software firms selling to the financial services industry would theoretically have their binary code scanned by HP Fortify or Veracode, which provide that type of software vulnerability scanning, for example.

"The results of the scans would be shared with the financial industry," Routh says. "Today the model is the financial [firms] paying for that," but Veracode, for instance, has a program that in the future would shift that cost to the vendors, he says.

Third-party software and services vendors would then share the cost of one assessment for multiple financial services clients, he says. The same goes for vBSIMM: "If I am a software vendor and do a BSIMM assessment, that same assessment is shared with many of my clients."

The open-source policy management control, meanwhile, helps financial industry firms to ensure their developers are employing the newest versions of open-source software, as well as more reliable and resilient libraries.

"Today, 80 to 90 percent of custom development uses open-source libraries to build an application," Routh says. "And 26 percent of the most commonly downloaded open-source libraries are riddled with high-risk vulnerabilities."

Policies would enforce using reliable sources for open-source software and ensuring that only the most current versions are used.

Still, the FS-ISAC won't be enforcing the recommended security policies for third-party software and services. "The working group is saying this has been a problem for some time, and there are no easy answers or quick fixes. But these controls should be considered to be adding to third-party [software] governance," Routh says. "We're looking at standardizing on a set of controls that improve risk management across the [financial services] industry, and also make it easier on vendors at the same time."

The FS-ISAC working group's white paper is available here (PDF) for download.

Have a comment on this story? Please click "Add Your Comment" below. If you'd like to contact Dark Reading's editors directly, send us a message.