Open Source Software (OSS) has many benefits, but in recent years we've seen an increase in the number of attacks on applications through their OSS dependencies. I present five principles to help you use OSS safely, as well as a collection of tools to help you apply these principles in your own software supply chain. I put a special emphasis on automation, because the weakest part of even the most secure system is the humans that operate it.

1. @djsauble
Open Source Software
Please Drink Responsibly

2. OSS Is Great And All
But It Can Burn Your House Down

4. Infra
As
Code

5. OSS
Supply
Chain

6. Node
Pkg
Mgmt

7. OSS

8. How is OSS
consumed?

13. What could
go wrong?

14. Infiltration

16. 404

18. Typo-
Squatting

20. Dependencies

22. Age

24. How do we keep
the wheels on
the bus?

25. Pick a Trusted Source
Check for Quality Issues
Cache Everything
Bundle Everything Together
Scan Regularly

26. Pick a Trusted Source

28. Documentation
Source
Signed
Coordinates
Project
License
Developers
Examples

31. Check for Quality Issues

32. Academic Free License · Affero General Public License ·
Apache License · Apple Public Source License · Artistic
License · Beerware · BSD License · Boost Software
License · Creative Commons Zero · CC-BY · CC-BY-SA ·
CeCILL · Common Development and Distribution License ·
Common Public License · Cryptix General License ·
Eclipse Public License · Educational Community License ·
European Union Public Licence · GNU Affero General
Public License · GNU General Public License · GNU
Lesser General Public License · IBM Public License · ISC
license · LaTeX Project Public License · Microsoft Public
License · MIT license / X11 license · Mozilla Public
License · Netscape Public License · Open Software
License · OpenSSL license · Python Software Foundation
License · Q Public License · Sleepycat License · Unlicense
· W3C Software Notice and License · Do What The F**k
You Want To Public License · XCore Open Source License
· XFree86 1.1 License · zlib/libpng license

33. 116,923
CVEs

35. vs.

36. • 0day.today
• cve.mitre.org
• cvedetails.com
• cxsecurity.com
• exploit-db.com
• kb.cert.org
• nvd.nist.gov
• ossindex.sonatype.org
• rapid7.com
• seclists.org
• securityfocus.com
• vuldb.com
• vulnerability-lab.com
• vulners.com
• zerodayinitiative.com
Vuln Databases

37. Cache Everything

40. Internet
Local Network
Local storage
Memory
L3 Cache
L1 Cache

41. ManyOne
Hosted
On-Prem
•Nexus Repository Manager
•Artifactory
•Docker Registry
•DockerHub
•ProGet

42. Bundle Everything Together

44. "dependencies": {
"express": "latest",
"mongodb": "^4.0.0",
"async": "2.6.2"
}

46. Scan Regularly

48. Vulnerabilities
Over Time

54. • Audit.js
• Audit.NET
• Clair
• Dependabot
• DotNET Retire
• Dependency Check
• Dependency Track
• DepShield
Application Scanners
• GitHub
• Maven Audit Plugin
• Nancy
• PHP Security Checker
• Renovate
• Retire.js

55. How To Tell If You’re
Doing This Right™

56. The Checklist
Manifesto

58. Accelerate

60. The Power of
Little Ideas

61. Pick a Trusted Source
Check for Quality Issues
Cache Everything
Bundle Everything Together
Scan Regularly

62. Thank You!
@djsauble

63. Photo CreditsAlina G
https://unsplash.com/photos/RPLwFFzNvp0
https://unsplash.com/photos/o1PKM7-8AH4
Ashim D’Silva
https://unsplash.com/photos/SvhXD3kPSTY
Bas Emmen
https://unsplash.com/photos/EXpa6pyXkHA
https://unsplash.com/photos/Kw_zQBAChws
Carlos Irineu da Costa
https://unsplash.com/photos/eMc0lpn1P60
Chris Lawton
https://unsplash.com/photos/duQ1ulzTJbM
Christian Fregnan
https://unsplash.com/photos/ewiYQxLTGEU
Christian Wiediger
https://unsplash.com/photos/6t8PMIfqNVg
Claudio Schwarz
https://unsplash.com/photos/V0b3zu94MPw
Randall Munroe
https://xkcd.com/1987/
Ruben Mishchuk
https://unsplash.com/photos/EC5AQfxgxdE
Ryoji Iwata
https://unsplash.com/photos/IBaVuZsJJTo
SpaceX
https://unsplash.com/photos/IuE715vJo2I
Teemu Paananen
https://unsplash.com/photos/bzdhc5b3Bxs
Terry Vlisidis
https://unsplash.com/photos/0dhIwRsPV74
Thijs Schouten
https://unsplash.com/photos/U9bEQYPG-1Q
David Clode
https://unsplash.com/photos/hUidMW9NvmA
Elijah O'Donnell
https://unsplash.com/photos/t8T_yUgCKSM
Felix Koutchinski
https://unsplash.com/photos/WEcl8_kqwpg
Jagoda Kondratiuk
https://unsplash.com/photos/sDeGlMAwcH4
Jezael Melgoza
https://unsplash.com/photos/HYQvV8wWX18
Kit Ko
https://unsplash.com/photos/Ejtj7hvEYcg
Mitchell Johnson
https://unsplash.com/photos/CZRNxAIYLzI
mnm.all
https://unsplash.com/photos/46Yad80Ynp4
Pedro Lastra
https://unsplash.com/photos/Nyvq2juw4_o