What Every Chief Security Officer Must Know About Open Source Software