11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey
summary
Four-year survey covers 3,300 responses in April 2014 (11,000 total to date) and delivers hard numbers: 75% of organizations don’t enforce open-source policies, only 16% must prove they avoid known-vulnerable components, and 64% don’t track vulnerability changes over time. Heartbleed spikes reporting and exposes slow supply‑chain visibility—DHS takes weeks to assess impact. Practical fixes shown: build a bill‑of‑materials, deploy lightweight inventory agents, automate library checks in CI, and ship executable proofs (Zest/ZAP scripts, Gauntlet, chaos‑style tests) to move security left.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:57Jeff Williams
- 3:23Damon Edwards
- 4:27Matt Johansen
- 6:59Do You Suspect an Open Source Related Hack within Your Organization
- 9:33Are these Open Source Related Breaches Avoidable
- 14:40Have any of Your Organizations Ever Banned the Use of an Open Source Component Just by Show of Hands
- 22:47Who in Your Organization Has the Primary Responsibility for Open Source Policy or Governance
- 25:37The Role of the Security Professional Has To Shift to Being Toolsmiths and Coaches
- 26:08Devops Track
- 45:43The Survey Results
related talks
39mOpen source security: who’s responsible?
38mApplication Security in the age of Open Source
01h 06mStrengthen open source software supply chain security: Log4Shell to xz
58mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
14mThe State of Open Source Vulnerabilities Management in 2019
16mKeynote: There Is Just One Way to Do Open Source Security: Together
47mThe Open Source Paradox: Unpacking Risk, Equity, and Acceptance
13mKeynote: Hacking the OSS Supply Chain