An Introduction to the Newest Addition to the OWASP Top 10
summary
OWASP A9 warns that component risk is concrete: Sonatype Central sees 8 billion requests annually and about 20 million downloads per week, and an analysis of 113 million pulls finds roughly 26% are known‑vulnerable (≈26 million) across ~60,000 organizations. Practical steps shown include inventory via app‑server sensors or CI, use of Maven/dependency trees and dependency‑check, SHA1 mismatches from repackaging, and that ~25% of JARs often remain unknown to scanners.
AI-written summary · about
chapters (5)
- 0:00Start
- 1:26Jeff Williams
- 15:18Dependency Resolution
- 44:27Whole App Analysis
- 48:07Using Components with Known Vulnerabilities
related talks
45mOWASP A9: A Year Later - Are you still using components with known vulnerabilities?
32mAdapting DevOps in a World of Growing Software Supply Chain Attacks
25mOWASP Top 10 Risks for Open Source Software
31mOpen Source Supply Chain Threat Landscape - A Moving Target
37mThe Death Star and the Ultimate Vulnerability
37mIt’s Not Open Source, It’s You. Where Open Source Risk Comes From
33mThree Things That Each Developer Should Know to Help Secure Code Base
41mSponsored Session: Software Supply Chain Threat Landscapes: A Moving Target