Learn about our latest product updates and improvements we’ve made in the past few months.

1. Product Update
Webinar
September 2018 Edition
David Habusha
VP Product
September 2018

2. 2
Today’s Agenda
 Release of Effective Usage Analysis
 Unified Agent: Strategy and Support for New
Platforms
 Fortify SSC Integration
 Workflow Enhancements
 Quicker Navigation
 Customer Community Portal
 Q4 2018 Outlook
 Q&A Session

3. New Effective Usage Analysis
Technology Released

4. 4
Problem:
? ?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
? ?
?
?
?
?
?
vs.
4
Reported Vulnerabilities Are Not Necessarily EFFECTIVE
?
?
?
?
?
Reported Vulnerabilities
Can you really handle all of them?
Which ones constitute a real risk?
Which ones should be addressed first?
Effective Vulnerabilities
Less to deal with. Much less.

5. 4
Problem:
? ?
?
?
?
?
?
?
?
?
?
?
?
?
?
?
? ?
?
?
?
?
?
vs.
5
Reported Vulnerabilities Are Not Necessarily EFFECTIVE
?
?
?
?
?
Reported Vulnerabilities
Can you really handle all of them?
Which ones constitute a real risk?
Which ones should be addressed first?
Focusing on Effective Vulnerabilities Could Enable:
Better development efficiency
Better development effectiveness
Better security

6. 5
On average, 70%* of
reported security
vulnerabilities
in open source libraries
are NOT referenced
by the developers’ code
70%
30%
Non-Effective
Effective
* Based on preliminary
research by WhiteSource
ReferencedNot Referenced
Solution: Identify and Focus on Effective Vulnerabilities

7. • State of the art analysis technology that enables
organizations to determine if and how their software
projects are effectively exposed to reported open source
vulnerabilities
• Powerful and intuitive user experience that facilitates
quick assessment and prioritization of vulnerability
remediation options
6
What Is
Effective
Usage
Analysis?

8. 78
Significant savings
by enabling developers to
focus on real, actual risks
Better cooperation
between DevOps and
Security teams
Actionable insights
about security
vulnerabilities
Maximized accuracy
of risk assessment
Easier remediation
processes
Significant savings Better cooperation Actionable insights
Maximized accuracy Easier remediation
The Value
Proposition Of
Effective Usage
Analysis

9. 79
Significant savings
by enabling developers to
focus on real, actual risks
Better cooperation
between DevOps and
Security teams
Actionable insights
about security
vulnerabilities
Maximized accuracy
of risk assessment
Easier remediation
processes
Significant savings Better cooperation Actionable insights
Maximized accuracy Easier remediation
The Value
Proposition Of
Effective Usage
Analysis

10. Effective Usage Analysis Release
 Free for all WhiteSource customers
until the end of 2018
 Currently supports Java and related
package managers (such as Maven
and Gradle) as well as POJO
 Contact your customer success
representative to gain access now!

11. Effective Usage Analysis Release (Cont’d)

12. Effective Usage Analysis Release (Cont’d)

13. Well… we’ve got good news.
Join our Effective Usage Analysis
JavaScript beta program now!
What’s in it for you? Free access to the technology for an
extended period of time!
Sign up here: product@whitesourcesoftware.com
Missed Out On Our Last Beta Round?

14. Unified Agent

15.  WhiteSource Unified Agent Strategy
allows customers to use a single
agent for all integrations
 WhiteSource Unified Agent Strategy
facilitates simplified maintenance
and updates as well as centralized
configurations
Unified Agent Strategy using FSA
Gone are the days of multiple
plugins and agents….
But until then…
 WhiteSource supports a single,
unified agent with all functionalities
 New functions and bug fixes are
being delivered in the File System
Agent (FSA) only
Our recommendation? Use FSA only!
 Check out our documentation which
has detailed, updated information
regarding our FSA

16.  Go: Gopm, Dep, GoDep, vndr,
GoGradle, Glide
 Python: Pip and setuptools
 Scala: SBT
Unified Agent - Support For New Platforms
Supporting* New Package Managers
 Ruby: RubyGems
 PHP: Composer
 iOS: Cocoapods
 TypeScript: NPM
*Supports direct & transitive dependencies as well as Web Advisor detection

17.  AWS CodeBuild
 Google Cloud Build
 Travis CI
New Build/CI Tools
Integrated With Unified Agent
Supported Build Tools Now
Integrated With Unified Agent
 Jenkins
 TFS/VSTS
Unified Agent - Support For New Platforms

18. Fortify SSC Integration

19. Fortify SSC Integration
17
 Monitor your proprietary and open-source vulnerabilities in one dashboard
 Extend security issues in Fortify SSC’s dashboard with actionable information on
found open source vulnerabilities
 Prioritize remediation efforts with advanced filtering and aggregation options
 Ensuring continuous, automatic security alerts synchronization, and same day
alerts for new vulnerabilities
 Support for Fortify SSC 17.20 & 18.10

20. Fortify SSC Integration (Cont’d)
18

21. Fortify SSC Integration (Cont’d)
19

22. Workflow Enhancements

23. Workflow Enhancements
#1: User Level Access Control
 User-level access controls have
been added so you can
segregate between users
and/or products
 Control and audit actions
executed by users (such as
scans, API calls, admin actions)

24. Workflow Enhancements (Cont’d)
#2: Documentation Changes
 Users can add comments for
designated actions
 Inventory and license changes
will now automatically indicate
source of change
(user/system)

25. Workflow Enhancements (Cont’d)
#3: Reports
 New “Change Log History” report includes a log of all the inventory
changes made (user/system)
 The Report can also be obtained via API

26. Workflow Enhancements (Cont’d)
#4: Allow failing builds on
conditional policies
 ‘Reassign’ and ‘Conditions’
Policies now allow to fail builds
in case of a policy match

27. Workflow Enhancements (Cont’d)
#5: Open tasks on initial
project scan
 Open pending tasks for new
libraries in a new project, in
addition to existing projects

28. Quicker Navigation

29. 27
Quicker Navigation
Our goal? To improve your
dashboard performance
 Access your “most viewed
products” faster
 Select projects directly
 Auto-complete and search
Product and Project names

30. Customer Community Portal

31. Customer Community Portal
What’s In It For You?
 Centralized, personalized view of all your issued support cases
 Subscribe to receive email updates on:
 Product announcements and updates
 Early product release notes

32. Q4 2018 Outlook

33. What To Look Forward To In Q4 2018…
 Enhanced GitHub Integration
 Detailed Release Management Report
 Central Configurations

34. Q&A

35. THANK YOU
For more info please contact us: product@whitesourcesoftware.com
WhiteSourceSoftware.com