The document discusses the challenges of securing open source components in DevOps, highlighting that 96.8% of developers rely on them, yet security vulnerabilities are rising, with a 51% increase in reported vulnerabilities in 2017. It emphasizes the need for efficient prioritization of fixes based on business impact and suggests integrating security throughout the software development lifecycle by automating scanning, prioritization, and remediation. Key takeaways include knowing your code and monitoring it frequently to enhance security measures.

1. Open Source Security at Scale
The DevOps Challenge

2. Hello!
Shiri Arad Ivtsan
Product Manager @WhiteSource
Shiri.ivtsan@WhiteSourceSoftware.com

3. Continuous Delivery

4. Continuous Delivery

5. Open Source
96.8%of the developers rely on
open source components

6. Security in Open Source

7. Some Basic Statistics
* Based on a survey conducted in more than 650 companies

8. OSS Security Vulnerabilities Are On The Rise
51%
The observed YoY rise
of reported vulnerabilities in 2017

9. Open Source Challenges
Onechallenging area in particular
is pronounced

10. Companies Do Not Prioritize Their Fixes Efficiently
Criticality of the project that might be impacted by the vulnerability
Availability of the suggested fix
Perceived impact of the vulnerability on projects
Number of software libraries containing the vulnerability
Vulnerability severity
Creation date of the vulnerability alert
prioritize based on the real business
impact
~56%
Just

11. Recent News
Integrity Availability Security-Protection

13. Security Throughout The
SDLC Pipeline

14. Scan

15. CI/CD Pipeline
Code Build Package Deploy

16. Code
Code Build Package Deploy
• Choose the right component from the earliest
stages
• Automatically open pull requests for patches
• Restrict merges if vulnerabilities exist

17. Build
Code Build Package Deploy
• Scan on any build
• Fail builds based on policies (i.e high severity
vulnerabilities)

18. Package
Code Build Package Deploy
• Scan Docker images – in private and public
image registries

19. Deploy
Code Build Package Deploy
• Scan upon deployment to your production
platform
• Monitor running applications in production for
newly published vulnerabilities

20. Key Takeaways
Know your code
Monitor it frequently
Make it simple & faster: Automate
• Automate the scanning
• Automate the prioritization
• Automate your remediation

21. Q&A