Practical Approach to Automate the Discovery & Eradication of Open-Source Software Vulnerabilities

on YouTube ↗51m

" summary

Netflix builds an automated pipeline that discovers, triages and remediates OSS flaws at microservice scale: it ingests commercial vulnerability feeds and NVD, indexes published artifacts, Debian modules and AMI manifests to map vulnerable versions to container and instance IDs, and applies a risk formula using CVSS, exploit-in-the-wild, application sensitivity and vulnerable method executed signals. Remediation uses minimum-version computation (via unified range), resolution rules, auto-PRs, dependency-lock updates and 90‑day security deprecation cycles, which measurably reduce impacted services over time.

AI-written summary · about

" chapters (26)

1. 0:00Intro
2. 3:16The Benefits of Open Source Software
3. 5:50Open source security is a strange thing
4. 9:16Typo squatting
5. 10:11Package Masking
6. 11:28Ownership transfer
7. 12:07Dangling references
8. 13:10Picking a target for infection
9. 13:49How dependencies gets infected?
10. 15:48How can we protect ourselves from supply chain attacks?
11. 17:34Netflix Microservice Architecture
12. 18:13Design principles for our approach
13. 19:22Build open source vulnerability database
14. 25:55Vulnerability Triage
15. 27:43Risk Strategy Table - Example 1
16. 28:58Requirements for effective vulnerability remediation
17. 29:26Understanding minimum version update problem
18. 31:08First order dependency problem
19. 35:57Yarn Selective dependency resolutions - Example
20. 37:47Dependency lock updates
21. 38:21Security Change Campaigns
22. 39:47Security Change Campaign - Blacklist
23. 42:19Vulnerable method use detection
24. 43:59Better remediation (slack bot remediation)
25. 44:41Questions we ask for organizational metrics
26. 45:53Blackhat sound bytes

" related talks

• 39mFrom Discovery to Fix: What 10,000 Open Source Projects Reveal About CVE RemediationMor Weinberger · FIRST Conference 2026 (FIRSTCON26)
• 25mAutomating Cyber Threat Intelligence: A Practical Approach to Managing Emerging VulnerabilitiesAndy Giron, Fred Baguelin · 2024 FIRST Cyber Threat Intelligence Conference
• 41mManaging the risk and growth of using Open Source SoftwareJason Hammond · foss-north 2020
• 11mIdentifying Security Vulnerabilities at Scale: Venture Inside a PipelineJustin Young · DevOps World | Jenkins World 2019 San Francisco
• 13mManaging Vulnerabilities in Open-Source DependenciesEva Sarafianou · SOSS Community Day Europe 2024
• 35mPractical DevSecOps for private and open source projectsSven Ruppert · JCON 2020
• 46mScaling the Security Researcher to Eliminate OSS Security Vulnerabilities Once and For AllJonathan Leitschuh · Open Source Summit Europe 2023
• 29mContainer vuln management with (hopefully) minimal...Alex Chantavy · BSidesSF 2023