This Webinar identifies the most common value and risk questions we hear asked regularly by businesses implementing open source software (OSS) scanning. We believe sharing the answers to these questions will help you better understand why, and under what conditions you really can’t afford to do without an OSS scanning solution.

1. 1© OpenLogic, Inc. - Licensed under CC-BY
Understand Scanning
for Open Source Code
and Why YOU Can’t Afford
Not to Scan!
Thursday, June 27, 2013 11:00 AM MST
Live Webinar!

2. 2© OpenLogic, Inc. - Licensed under CC-BY
Welcome! Today’s presenters are:
Expert Auditor and Presenter:
Dave McLoughlin,
Director of Open Source Software
Auditing Services at OpenLogic
Dave.mcloughlin@openlogic.com
Moderator:
Caitlin Rogers,
Senior Director of Marketing at
OpenLogic

3. 3© OpenLogic, Inc. - Licensed under CC-BY
About OpenLogic
 OpenLogic helps Enterprises use Open Source Software
 What does this mean?
– We offer industrial strength source code scanning software
• OSS Deep Discovery
– We offer a cloud-based governance and compliance platform
called OLEX where you can:
• Set-up your open source policy
• Keep track of your open source inventory
• Mange open source usage in your organization
• Run source code scans via OSS Deep Discovery
• Access open source repository of resolved licenses
• Audit your open source code
• Resolve open source licenses
– Expert Auditing Services:
• If you don’t have the internal expertise, you can hire our experts
to scan and analyze your files for you
• We offer indemnification on all audits

4. 4© OpenLogic, Inc. - Licensed under CC-BY
What we will learn in today’s webinar:
 Why you need to be scanning for open source software?
 What are the RISKS of NOT scanning?
 Why you can’t afford to NOT scan?
 What is the difference between binary scanning and
source code scanning?
 Are cloud scanning solutions (SaaS) safe, secure and
effective?
 Is accuracy more important than fingerprint size in source
code scanning?

5. 5© OpenLogic, Inc. - Licensed under CC-BY
Why should you scan for open source?
Do you need to scan your source code?
 Do you distribute open source code, or sell products containing
open source software?
 CAUTION!
– You don’t have to be selling software in order to be distributing it!
 Do you offer apps available for download on your Website or via app
marketplaces like iTunes, Google Play?
 Do you need an internal inventory of all your source code and what’s
contained therein?
 Is your organization engaged in merger and acquisitions?
 Do you outsource software development?
 Do you contribute code to open source projects?

6. 6© OpenLogic, Inc. - Licensed under CC-BY
Use of
OSS under GPL
Revisions made to OSS
Linked to or bundled with
proprietary code Use by wholly
owned sub
Sub is sold to
a 3rd party
Internal Use
Use by an
outsourcer or
contractor
Software shared
with
“partner”
during further
development
Software
distributed to
end users
Using OSS Distributing OSS
Changes in how OSS is used can impact license compliance
When is OSS “distributed”?

7. 7© OpenLogic, Inc. - Licensed under CC-BY
Did you answer YES to any of those questions?
If you answered  YES to any
of the previous questions, you
should be scanning your source
code.
What are the risks of NOT scanning?
Avoiding source code scanning is NOT worth the RISK!

8. 8© OpenLogic, Inc. - Licensed under CC-BY
Why you can’t afford to NOT scan?
 Legal Risks:
– Lawsuits
– Audits
– Loss of Ownership
 Security Risks:
– CVE
 Maintenance:
– Features
– Performance
 BONUS!
– Human Error
– Unused code
– Accidental use
Potential Risks and Costs of NOT Scanning

9. 9© OpenLogic, Inc. - Licensed under CC-BY
What is the difference between binary scanning
and source code scanning?
 Most companies need to undertake source code scanning and not just
binary scanning. What is the difference?
 Source Code Scanning
– Used on source code AND binaries
– Finds open source packages, copied snippets, and licenses
– Recommended for any software that is distributed
 Binary Scanning or Inventory Scanning:
– Used on binaries, doesn’t scan all source code
– Finds OSS packages used
– Effective for taking software inventories on machines
and applications
– Not as thorough or comprehensive as a source code scan
– OpenLogic offers a free binary scanner called
OSS Discovery; it’s one of OpenLogic’s many
contributions to the open source community
http://www.openlogic.com/resources-library/binary-source-code-scanners/

10. 10© OpenLogic, Inc. - Licensed under CC-BY
Are cloud scanning solutions (SaaS) safe, secure
and effective?
 OLEX provides a unique private cloud solution. The source code
NEVER leaves the safety of your firewall.
 The results of the scan are fingerprinted with a one-way hash code,
which can not be used to reveal your code, as it just provides a
“digital” reference.
 That fingerprint is returned securely (SSL) via the cloud
and results of the scan are produced into a
bill of materials or BOM.
 This is highly secure, private and most importantly
your code remains anonymous.
 We provide a security whitepaper with details on the
measures we take in our product and data centers
to keep your information secure.
 http://www.openlogic.com/resources-library/data-sheet-openlogic-exchange-olex/

11. 11© OpenLogic, Inc. - Licensed under CC-BY
Accuracy vs. Size of Fingerprint Database
 High Accuracy, Low Noise
– Multiple matching techniques to find projects, files, snippets and modified
code
– A focus on accuracy helps to reduce false positives and better identifies a
correct license match
– Scanner employees multiple noise reduction techniques
– More fingerprints don’t always mean better results. Fewer, targeted
results produce faster analysis
 SaaS crowd sourcing
– Leveraging the work of others
– Boosting results
– Suggestions

12. 12© OpenLogic, Inc. - Licensed under CC-BY
What we learned in today’s webinar:
 Why you need to be scanning for open source software?
 What are the RISKS of NOT scanning?
 Why you can’t afford to NOT scan?
 What is the difference between binary scanning and
source code scanning?
 Are cloud scanning solutions (SaaS) safe, secure and
effective?
 Is accuracy more important than fingerprint size in source
code scanning?

13. 13© OpenLogic, Inc. - Licensed under CC-BY
Thank You!
 Want to Learn More?
– Get a demo of OSS Deep Discovery:
http://www.openlogic.com/products/olex/
– The First 5 Attendees Who Request a Demo Will Get the Following:
– A free Scanning Account Set-up on OLEX
– 1K FREE files scanned of your source code!
– 1 Hour FREE review of your source code with an Expert Auditor
 Contact us:
– 1.888.OPENLOGIC | marketing@openlogic.com | Twitter @openlogic
www.openlogic.com | olex.openlogic.com
Source Code Scanning made Secure, Accurate, Effective & Simple