Perception vs Reality: What Data Says About Open Source Risk Management?
summary
A Sonatype presentation reports findings from its 8th State of the Software Supply Chain survey, empirically analyzing dependency update practices across thousands of open-source projects and hundreds of survey responses. It compares perceived vs. actual security risk management, highlights new trends in open-source component consumption, and identifies team-structure factors that correlate with better supply-chain hygiene, with recommendations for data-backed practices to manage open-source supply-chain risk.
AI-written summary · about
chapters (10)
- 0:00Conference intro
- 3:59Supply chain reports
- 6:11Open source vulnerabilities
- 10:04Vulnerable components
- 15:46Producer-consumer issues
- 18:14Security best practices
- 22:09Component security score
- 26:39Risk management tips
- 30:11Q&A
- 36:58Conclusion
related talks
37mIt’s Not Open Source, It’s You. Where Open Source Risk Comes From
25mOWASP Top 10 Risks for Open Source Software
32mWhy You Should Care About Open Source Supply Chain Security
41mBack to Security Basics: Evaluating, Consuming, and Contributing Open Source...
45mPanel Discussion: Managing Open Source...
41mManaging the risk and growth of using Open Source Software
41mManaging the Risk of Software Supply Chain Attacks
27mBeyond Open Source Risks With the CRA and NIS2