Dealing with the fallout from a massive exploit is everyone’s nightmare. Time and time again these vulnerabilities are found in open-source software. Does this mean we can’t trust open-source and should be developing everything from scratch? No, it’s not feasible or sustainable for anyone’s environment. So how do you handle this code that is embedded everywhere? In this talk, I’ll discuss the concerns open-source code and dependencies bring to any environment. We’ll start off by taking a historical look at vulnerabilities and their impact. Through this, we’ll look at methods for discovery, triage, and remediation. I focus on core tenants of remaining flexible, scalable, and integrating automation with the overall goal of reducing both risk and operational costs. The tradeoff between productivity, cost, and security doesn’t have to be a pick 2, lose 1 type scenario.

6. Shellshock

7. Heartbleed

8. But I don’t use
open-source…

10. Library
Direct
Dependency
Indirect
Dependency
Indirect
Dependency
Indirect
Dependency
Direct
Dependency
Indirect
Dependency

11. We’ll develop it
in-house

12. Open-Source Considerations
• Free to Trial
• Free Support (community)
• Fewer Bugs and Faster
Fixes
• “Better” Security
• Avoids Vendor Lock-In
• Reduced Competitive
Advantage
• Minimal Support Leverage
• Usability
• Increased Business Risk
Pros
Cons

13. Proprietary Considerations
• Usability
• Product Stability
• Ownership
• Tailored Support
• Dependency
• Software Opacity
• Developer Enticement
Pros
Cons

14. Software Bill of Materials (SBOM)

15. What should
an SBOM
contain?

16. EASE OF
INFORMATION
INPUT
THREAT
INTELLIGENCE
THREAT
DASHBOARD
MITIGATION
DASHBOARD
RULE ENGINE SCALABILITY INTEGRATION
WITH EXISTING
WORKFLOW
REPORT
GENERATION

17. Technical Security Reviews

18. ✓ Urgent
X Important
✓ Urgent
✓ Important
X Urgent
X Important
X Urgent
✓ Important

19. Detection

21. Here is a crazy
idea…
Contribute to research and open-source
code development

23. Proprietary and confidential
Questions?
• /in/brandon-devault
• @SolderSwag
• www.devaultsecurity.com
• brandon-devault@pluralsight.com
• https://github.com/Pluralsight-SORCERI

24. Proprietary and confidential
References
• https://googleprojectzero.blogspot.com/2022/04/the-more-you-know-more-you-
know-you.html
• https://blog.qualys.com/vulnerabilities-threat-research/2022/03/18/infographic-
log4shell-vulnerability-impact-by-the-numbers
• https://www.imperva.com/blog/shellshock-bash-vulnerability-aftermath/
• https://securityintelligence.com/xforce-report-2014-q3-heartbleed-still-matters-
age-pervasive-exploits/
• https://www.synopsys.com/blogs/software-security/open-source-trends-ossra-
report/
• http://www.optimusinfo.com/downloads/white-paper/open-source-vs-proprietary-
software-pros-and-cons.pdf
• https://www.simscale.com/blog/2017/06/open-source-vs-proprietary-software/
• https://github.com/CycloneDX/bom-examples
• https://www.toolbox.com/it-security/vulnerability-management/articles/top-
threat-modeling-tools/
• https://www.linkedin.com/pulse/secure-code-review-practice-enhance-user-
experience-protecting-kumar/