Identifying Security Vulnerabilities at Scale: Venture Inside a Pipeline
summary
Live demonstration exploits a Struts2 RCE to open a calculator and illustrates end-to-end pipeline defenses using Jenkins, Nexus and Sonatype automation. Shows concrete numbers: 3.5 million Java components in the ecosystem and an example project with 125 dependencies, 3 vulnerable. Uses OSS Index and Nancy CLI to detect issues, breaks builds selectively based on context, and describes automated remediation and ticketing integration; emphasizes reducing false positives and the need for an internal champion.
AI-written summary · about
chapters (13)
- 0:00Introduction
- 0:22Open Source
- 0:59Software Supply Chain
- 1:31Open Source vs Closed Source
- 2:26Demo
- 3:59Github Security Alerts
- 5:54OSS Index Tools
- 6:19Security at Scale
- 6:45Context
- 7:49Precision
- 8:43Tooling
- 9:19Champion
- 9:53Outro
related talks
01h 32mYour Applications are Under Attack: Protecting each step of the development lifecycle
39mContinuous Security at the Next Level
40mEmbracing Security - A Changing DevOps Landscape
27mFind and Track the hidden vulnerabilities inside your dependencies
43mBuilding a Secure DevOps Pipeline
46mLive hacking: Breaking into your Java web app
32mTutorial: Yes, Your Applications are Under Attack - Struts2 Vulnerability Workshop
52mDevSecOps