Get an Audit – OSTIF.org

Before you get an audit, you should ideally do some preliminary checks yourself first. This saves time and money as we’d be doing that first anyway. Check our open source best security practices guide here on Github.
The costs of an audit varies but it’s typically tied to the complexity, labor hours, and type of audit (e.g. is there complex cryptography involved? does it have lots of integrated parts? how much testing has already been done?). As initial audits could range anywhere from $30k to $200k, we have helped many projects raise funds and source sponsors to cover the entire costs or to split them.
An audit isn’t just a single process or service, it’s a relationship with auditors that leads to discoveries and improved processes now and in the future. This means recurring audits would ideally find fewer vulnerabilities, and future updates would be written more securely based on learned experience.
The most critical step of any audit is reaching out to talk to us about what you actually need and how we can help. Even if you don’t end up doing a full audit, we still want to hear from you and what you’re working on, give any advice we can, and help you find the resources you need.
OSTIF works with you to figure out what code needs auditing, what it’s supposed to do, and how that audit should be done. Then we select an appropriate audit team to tackle it. We choose the best team based on your needs for expertise, quality and cost.
We champion your audit through consulting, liaising, and managing quality control every step of the way with the auditors. We focus on timeliness and accuracy while making sure you, your project manager, and the auditing professionals are all on the same page with clear expectations. At this stage we discover what needs to be fixed and help you understand how to fix it.
We talk with you about priorities of what should be fixed and guide you on how to fix it in a way that auditors feel comfortable that it will remain secure.
After fixes are applied, we publish the report publicly so the whole open source ecosystem and especially your users can benefit from the knowledge that you not only care about their security and safety, but that your code is now professionally up to par.
A focused and correctly-scoped security review executed by an experienced team typically results in significant and long-lasting improvements to software and is one of the best ways to improve security posture in open source projects. According to “Zero Days, Thousands of Nights: The Life and Times of Zero-Day Vulnerabilities and Their Exploits” by Lillian Ablon and Andy Bogart, “products that have a longer life, are more complex, are popular with a large market share, or are high revenue generators, more people have evaluated the code bases, and finding vulnerabilities often requires more in-depth auditing, logic review, and source code analysis, in order to go several layers deep.” This has been the case with OSTIF, as our expert reviews have resulted in hundreds of bug patches, including the patching of over 100 Critical/High Impact Vulnerabilities. This document serves as a guide for projects that undergo security review through OSTIF.
OSTIF meets with you one-on-one to get to know you and understand your needs. Once a preliminary scope is defined, OSTIF sources professional auditors and experts from a diverse network. Bids are collected and analyzed based on cost and team expertise. After coordination and approval, OSTIF organizes communication between you and the audit team and moves the review forward.
The audit team gets to work. Code is evaluated for vulnerabilities based on the scope of the review. You are provided with updates as the review progresses. OSTIF manages the process and acts as a neutral party should any questions or concerns arise.
Auditors supply you with the results of the evaluation and assist with fixes and strengthening the code. This process allows for a lasting impact on the software’s security.
The updated code and audit report is released to the public. This provides assurance to users that the software has been expertly reviewed. Further maintenance via supplemental reviews of new updates and additional audits are available through OSTIF.
Pre-Audit – The following need to be completed by OSTIF prior to the beginning of the audit.
Audit – The following are completed throughout the audit process by the Audit Team.
Post Audit – The following are completed by everyone when the audit work is completed.
OSTIF: We are directors for the engagement, working to bring all necessary parties together on a timeline to initiate, pursue, and complete the work. In designing the engagement, OSTIF works in the front and back ends of the consultation to plot the undertaking from start to finish in the best way for all invested parties.
Security Team: This organization will perform the engagement work. Their responsibilities include carrying out the SOW, writing and presenting a final report of the work, and collaborating with the other parties to create a comprehensive understanding of the Project. They are not only auditors, but a great resource for the Project to learn more about security as it specifically relates to the Project and open source.
Project/Organization: A Project is the subject of the work. The Project’s responsibilities include a detailed questionnaire on behalf of the project, as well as whatever amount of time they’d like to contribute to the audit’s success. This includes participation in meetings throughout the process of the engagement, responsivity to questions via preferred communication methods, and the resolution of any findings with security impact to the satisfaction and approval of the Project.
A Security Review through OSTIF is intended to be a collaborative effort between Project Representatives (such as core maintainers, creators, community managers, or corporate representatives) and the Review Team. OSTIF undergoes a rigorous RFP and coordinat