Quiz Entry - updated: 2026.10.13
What should you check when sourcing a commercial component, an open-source component and a cloud service?
Commercial: certifications, CVEs, patch frequency, disclosure policy, hacking history. Open source: active project, CVEs, LTS versions, documentation. Cloud: ISO 27001 or SOC reports, provider size, hosting location, past breaches.
| Commercial component | Open-source component | Cloud service |
|---|---|---|
| Security certifications | Active vs. legacy project | ISO 27001 certificate, SOC reports |
| Known vulnerabilities (CVEs) | Known vulnerabilities (CVEs) | Size of the provider |
| Patch frequency | Long-term-support versions | Hosting location(s) |
| Responsible disclosure policy | Documentation of the source code | Past incidents and breaches |
| Current and past hacking (talks, blog posts, articles, videos) |
The common thread is evidence about the supplier's future behaviour. A product lives 10 to 20 years, so the question is not only "is it secure today?" but "will someone still fix it in year eight?" An abandoned open-source project with no LTS branch fails that test, however clean its code looks now. Conference talks about breaking a component tell you how attackers see it.
Go deeper:
OpenSSF Scorecard — automated health checks for an open-source project: maintenance, reviews, signed releases
System and organization controls (Wikipedia) — what SOC 1, 2 and 3 reports cover