Managing Vulnerabilities in Open-Source Dependencies
summary
Argues that open-source vulnerability management needs tooling plus process and gives concrete steps: define must-have requirements first (languages, package managers, SBOM, reporting), evaluate a maximum of three SCA tools tightly against known vulnerable samples, and execute a phase rollout of five repos with 15-day intervals to avoid overwhelm. Uses time-boxed investigations to answer test‑dependency and reachability questions, recommends months‑long evaluation and a leadership-backed sprint to clear historical findings before full enforcement.
AI-written summary · about
chapters (7)
- 0:00Introduction to talk
- 0:43Why dependencies matter
- 2:08Evaluating SCA tools
- 5:38Rolling out the tool
- 8:51Handling new vulnerabilities
- 10:40Key takeaways
- 12:06Q&A
related talks
25mYour Software Supply Chain is Only as Secure as its Weakest Link
51mOSS Supply Chain Threats and Why You Need a Holistic Security Strategy
40mSecure Your Code from Open Source Vulnerabilities
25mOWASP Top 10 Risks for Open Source Software
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
30mManaging Vulnerabilities through SSDLC
14mThe State of Open Source Vulnerabilities Management in 2019
43mThe Importance of Developer Tooling to Make Open Source More Secure by Default