OSS Security Maturity: Time to Put on Your Big Boy Pants!
summary
Claims that unmanaged OSS is a major enterprise risk and shows concrete fixes: BlackBerry measures 536 unique libraries across 75 product variants, finds up to 47 copies and 16 versions in a product, and reports a single FREAK incident costing $214,000. Engineering builds an integrated pipeline using Synopsys Protect/CodeSC, Risk Based Security VDB, Jira plus custom tools Vader, CMT and vulWatcher to automate bills of materials, triage and defect filing; automation cuts maintenance cost and speeds fixes (reported ~59% cost drop and ~12× faster patch delivery).
AI-written summary · about
chapters (12)
- 0:00Introduction and scope
- 3:31Defining open source risks
- 7:25Asset and attack surfaces
- 8:52Third-party library concerns
- 11:55Case studies of failure
- 16:32Government and legal oversight
- 20:25Product liability landscape
- 22:52Evaluating software security
- 26:35Blackberry's maturity journey
- 30:05Security maturity model
- 44:16Tooling and implementation
- 49:12Results and ROI
related talks
41mManaging the risk and growth of using Open Source Software
51mA Roadmap for Your OSS Security Lifecyle Journey to Protect Customers
30mA Lawyer and an Engineer Walk Into a Bar and Talk Open Source
39mWhat is Rugged all About?
38mApplication Security in the age of Open Source
31mThe Value of OSS Management for Risk Mitigation
33mOpen-Source Maturity in a 160-year-old organization: Technical and Legal hurdles
27mSecuring the Software Supply Chain: Integrating OpenSSF Scorecard, Jenkins, and the O...