The document discusses the integration of Black Duck into agile DevOps environments, emphasizing the need for early vulnerability detection in the software development lifecycle (SDLC). It highlights the challenges companies face in managing open source security and the advantages of automating checks to reduce costs, time to market, and risks. Key recommendations include ensuring builds only contain approved components and implementing automated checks in continuous integration processes.

1. Integrating Black Duck
in your Agile DevOps
Environment
Utsav Sanghani
Product Manager Black Duck Software

2. 2Black Duck Customer Conference
Continuous
Build & Test
Code
Assimilatio
n
Development
Configure
& Release
Packaging
CONVENTIONAL CHECKS HAPPEN VERY LATE IN THE SDLC

3. 3Black Duck Customer Conference
Continuous
Build & Test
Code
Assimilatio
n
Development
Configure
& Release
Packaging
CONVENTIONAL CHECKS HAPPEN VERY LATE IN THE SDLC

4. 4Black Duck Customer Conference
Continuous
Build & Test
Code
Assimilatio
n
Development
Configure
& Release
Packaging
CONVENTIONAL CHECKS HAPPEN VERY LATE IN THE SDLC; APPLICATIONS SHIP
WITH VULNERABILITIES

5. 5Black Duck Customer Conference
Continuous
Build & Test
Configure
& Release
Packaging
THE PROCESS IS MANUAL & NON LINEAR WITH ADDED TIME IN QUEUE BEFORE
RELEASE

6. How are Companies Managing Open Source Today? Not Well.HOW ARE COMPANIES MANAGING OPEN SOURCE TODAY? NOT WELL.
TRACKING VULNERABILITIES
• No single responsible entity
• Manual effort and labor intensive
• Unmanageable (11/day)
• Match applications, versions, components,
vulnerabilities
SPREADSHEET INVENTORY
• Depends on developer best effort or memory
• Difficult maintenance
• Not source of truth
MANUAL TABULATION
• Architectural Review Board
• Occurs at end of SDLC
• High effort and low accuracy
• No controls
VULNERABILITY DETECTION
Run monthly/quarterly vulnerability assessment
tools (e.g., Nessus, Nexpose) against all
applications to identify exploitable instances

7. IT IS IMMENSELY ADVANTAGEOUS TO MOVE LEFT
7Black Duck Customer Conference
1. REDUCED COSTS
Avoid human overhead costs

8. IT IS IMMENSELY ADVANTAGEOUS TO MOVE LEFT
8Black Duck Customer Conference
1. REDUCED COSTS
Avoid human overhead costs
2. REDUCED TIME TO MARKET
In process automation checks over post processing

9. IT IS IMMENSELY ADVANTAGEOUS TO MOVE LEFT
9Black Duck Customer Conference
1. REDUCED COSTS
Avoid human overhead costs
2. REDUCED TIME TO MARKET
In process automation checks over post processing
3. REDUCED RISK
Move checks to the left to facilitate higher remediation time with lower impact
Dev Ops

10. 10Black Duck Customer Conference
Continuous
Build & Test
Code
Assimilatio
n
Development
Configure
& Release
Packaging
FEEDBACK
A FEEDBACK LINK BETWEEN CI & DEVELOPMENT IS NEEDED TO SHIP COMPLIANT
AND SECURE PRODUCTS

11. BLACK DUCK PROVIDES FEEDBACK: CI/BUILD IS THE PLACE TO PLUG IN
AUTOMATED CHECKS (CURRENTLY)
11Black Duck Customer Conference
Continuou
s Build &
Test
Configure
& Release
Packaging

12. WHAT SHOULD YOU ASK YOU BUILD/RELEASE TEAM?
12Black Duck Customer Conference
• Does the build contain only approved open source
components?
• How secure is the build? Does it have any known
security vulnerabilities?
• Can we add diligence and remain agile?
• Where are you deploying the production builds?

13. 13Black Duck Customer Conference
JENKINS DEMO (7-10 MINS)

14. OBTAIN COMPREHENSIVE RESULTS INCLUDING DEPENDENCIES FROM BUILD
TOOLS LIKE MAVEN/GRADLE
14Black Duck Customer Conference

15. MANAGE CORRESPONDING ISSUES USING JIRA
15Black Duck Customer Conference

16. MANAGING THE ENTIRE POST BUILD AUTOMATION ACROSS CI PLATFORMS
16Black Duck Customer Conference

17. MANAGING THE ENTIRE POST BUILD AUTOMATION ACROSS CI PLATFORMS
17Black Duck Customer Conference

18. MANAGING THE ENTIRE POST BUILD AUTOMATION ACROSS CI PLATFORMS
18Black Duck Customer Conference

19. CONTINUOUS BUILD & INTEGRATION IS THE PLACE TO PLUG IN AUTOMATED
CHECKS (2017)
19Black Duck Customer Conference
Continuou
s Build &
Test
Configure
& Release
Packaging
1 5
4
3
2

20. COMPLIANT AND SECURE BUILDS VIA JENKINS: CHECK
20Black Duck Customer Conference
ALERT
New Vulnerabilities
Affecting You
IDENTIFTY
License
Compliance
Risks

21. 21Black Duck Customer Conference
THANK YOU