Download as PDF, PPTX
Uploaded byWhiteSource
Open Source Security at Scale- The DevOps Challenge
The document discusses the importance of managing open source security in DevOps, highlighting that 96.8% of developers use open source components. It emphasizes the rise in security vulnerabilities and the inefficient prioritization of fixes by companies. Key recommendations include automating scanning, prioritization, and remediation processes throughout the software development lifecycle.
More Related Content
Similar to Open Source Security at Scale- The DevOps Challenge
Open Source Security at Scale- The DevOps Challenge
- 1. Open Source Securityat Scale The DevOps Challenge
- 2. Hello! Shiri Arad Ivtsan ProductManager @WhiteSource Shiri.ivtsan@WhiteSourceSoftware.com
- 3.
- 4.
- 5. Open Source 96.8%of thedevelopers rely on open source components
- 6. Security in OpenSource
- 7. Some Basic Statistics *Based on a survey conducted in more than 650 companies
- 8. OSS Security VulnerabilitiesAre On The Rise 51% The observed YoY rise of reported vulnerabilities in 2017
- 9. Open Source Challenges Onechallengingarea in particular is pronounced
- 10. Companies Do NotPrioritize Their Fixes Efficiently Criticality of the project that might be impacted by the vulnerability Availability of the suggested fix Perceived impact of the vulnerability on projects Number of software libraries containing the vulnerability Vulnerability severity Creation date of the vulnerability alert prioritize based on the real business impact ~56% Just
- 11. Recent News Integrity AvailabilitySecurity-Protection
- 13. Security Throughout The SDLCPipeline
- 14.
- 15. CI/CD Pipeline Code BuildPackage Deploy
- 16. Code Code Build PackageDeploy • Choose the right component from the earliest stages • Automatically open pull requests for patches • Restrict merges if vulnerabilities exist
- 17. Build Code Build PackageDeploy • Scan on any build • Fail builds based on policies (i.e high severity vulnerabilities)
- 18. Package Code Build PackageDeploy • Scan Docker images – in private and public image registries
- 19. Deploy Code Build PackageDeploy • Scan upon deployment to your production platform • Monitor running applications in production for newly published vulnerabilities
- 20. Key Takeaways Know yourcode Monitor it frequently Make it simple & faster: Automate • Automate the scanning • Automate the prioritization • Automate your remediation
- 21.