What is Rugged all About?
summary
Argues that fixing software supply chains cuts broken releases and security debt: 41 OpenSSL CVEs one year, Maven Central sees 17 billion downloads, average app uses 106 OSS projects and 25% have high/critical vulns. Only 41% of Java project security defects ever get fixed; mean time to remediate is ~390 days (224 for severe). One org drops mean time to identify Heartbleed from 6.5 weeks to 6 minutes by using a bill of materials. Recommends supply chain hygiene, automated tests (Gauntlet, Chaos Monkey), config tools (Chef/Puppet) and the mantra be mean to your code.
AI-written summary · about
chapters (14)
- 0:00Introduction
- 0:19HONEY BADGER
- 6:01A TALE OF TWO QUAKES
- 9:51I Am The Cavalry
- 12:22The New Lifecycle
- 14:14Instrumentation
- 15:02Be Mean To Your Code!
- 15:42Complexity is the enemy of all the things
- 15:58Change Management finally
- 16:42Empathy tears down walls
- 18:24Software is an innovation differentiator
- 24:26Supply chain advantage
- 25:28A Fuller Embrace of Deming
- 29:56COMMERCIAL RESPONSES TO OPENSSL
related talks
30mDOES14 - Joshua Corman - Sonatype
45mWhat is Rugged All About?
52mOSS Security Maturity: Time to Put on Your Big Boy Pants!
41mThe Divine and Felonious Nature of Cyber Security
32mExemplars, Laggards, and Hoarders: A Data-driven Look at Open Source Software Supply Chains
46mThe Supply Chain Conundrum: Why Traditional Application Security Is...
22mSofware Supply Chain Security Is Hard. But Does it Need to Be?
40mEmbracing Security - A Changing DevOps Landscape