Building Secure Cars

6Software Composition Analysis in the Automotive Industry

SCIENTIA POTENTIA EST

As briefly described in Section 4.2.2, software composition analysis tools are primarily used to scan software to detect included open‐source software components and to identify corresponding known vulnerabilities and license information associated with the identified components. Armed with this information, automotive organizations can determine the risks of including certain open‐source software components in automotive software.

Open‐source software has become increasingly prevalent in the past few decades across multiple industries. Open‐source software components are included in numerous applications for mobile phones, they make up large parts of web browsers, do the heavy lifting in backend servers, and also now provide various functionality in automotive systems. Open‐source software has several benefits, such as enabling rapid innovation, reducing costs for non‐competitive technologies, and allowing organizations to focus more on developing new products and services. Other industries have already benefited from these advantages. For example, the Internet infrastructure completely changed in the late 1990s and early 2000s due to the usage of open‐source software. One of the most well‐known open‐source software projects is Linux, which is an operating system powering a large number of backend servers and running on many embedded devices today. Linux is a great example that demonstrates the ...