DevSecOps: Understanding Open Source Software risk in your applications
summary
Modern applications contain 96% had open source of code bases (99% if tiny apps excluded) with ~300 components on average and open source often composing over 50% of a codebase. 61% include copyleft licenses, 85% of components are ~4 years old, and ~60% of audited apps contain vulnerabilities (down from 78%). Example: Apache Struts CVE‑2018‑11776 shows a 10‑year old fault discovered, embargoed, patched, then public CVE tracking lagged. Use CI integration, IDE plugins, build‑process monitoring, file scanning and binary analysis to find and manage risk.
AI-written summary · about
chapters (14)
- 0:00Introduction by Josh
- 1:51Why open source matters
- 3:16Open source risk categories
- 4:44Open Source Security and Risk Analysis
- 6:13Open source usage stats
- 8:46License conflicts in code
- 10:55Staying on top of versions
- 12:17Security vulnerabilities overview
- 14:22Vulnerability lifecycle demo
- 17:55Trends in open source tooling
- 21:51Workflow automation in DevOps
- 22:13Identification techniques
- 26:31Optimal scanning integration points
- 28:20Key takeaways and conclusion
related talks
41mManaging the risk and growth of using Open Source Software
25mOWASP Top 10 Risks for Open Source Software
38mApplication Security in the age of Open Source
40mSecure Your Code from Open Source Vulnerabilities
25mYour Application is Mostly Written by Strangers
45mPanel Discussion: Managing Open Source...
47mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
14mThe State of Open Source Vulnerabilities Management in 2019