Download as PDF, PPTX
Uploaded byWhiteSource
Winning open source vulnerabilities without loosing your deveopers - Azure DevOps meetup
The document discusses the rise of open source vulnerabilities and the inefficiency of their handling, emphasizing the need for prioritization in managing these risks. It highlights that 30% of the top 100 open source projects have reported vulnerabilities and suggests that effective usage analysis can reduce alerts by 70% to 85%. Additionally, it introduces Whitesource Bolt as a practical tool for detecting and fixing open source vulnerabilities while ensuring license compliance.
More Related Content
Similar to Winning open source vulnerabilities without loosing your deveopers - Azure DevOps meetup
Winning open source vulnerabilities without loosing your deveopers - Azure DevOps meetup
- 1. Winning Open Sourcevulnerabilities Without Loosing your developers WhiteSource Software Internal and Proprietary Tsaela Pinto Director of Knowledge R&D
- 2.
- 3. Recent insights Open source vulnerabilities areon the rise Vulnerabilities handling is inefficient Prioritization is the key Usage analysis might reduce alerts by 70% to 85%
- 4. Reported open sourcesecurity vulnerabilities are on the rise
- 5.
- 6.
- 7.
- 8. 8 If they knewhow it was going to change their lives...
- 10. Heartblee d Stagefright Shellshock POODLE Celebrities vulnerabilities in OpenSSLin Bash in Android operating system in SSL 3.0 protocol
- 11. And it’s rising 51%theobserved YoY rise of reported vulnerabilities in 2017
- 12. 96%of the developersare relying on open source components > Affected developers
- 13. A lot ofVulnerable projects 32%of the top 100 open source projects have been reported with a vulnerability
- 14.
- 15. Most of themare already fixed 97%of the reported vulnerabilities have a suggested fix
- 16.
- 17.
- 18. Where can wefind them? Just 86% Are in the NVD
- 19. The Handling ofVulnerabilities Is inefficient
- 20. Top Challenge inusing open source component One challenging area is 1VULNERABILITIES
- 21. How much timeis spent? None 1 - 10 hours 11 - 20 hours 21 - 35 hours 36 - 60 hours Over 60 hours 15 hours/month spent on average by every developer on security vulnerabilities
- 22. What are thecommon tasks? 99%appear responsive and reactive… Nothing Research to better understand the vulnerability and its impact Remediate based on the open source community recommendation Report to the other teams (Security/DevOps) or a manager Remediate only through patches (if available)
- 23.
- 24. Common prioritization methods Criticalityof the project that might be impacted by the vulnerability Availability of the suggested fix Perceived impact of the vulnerability on projects Number of software libraries containing the vulnerability Vulnerability severity Creation date of the vulnerability alert 56 % opt for security/business-oriented prioritization
- 25. Vulnerabilities are notNecessarily EFFECTIVE
- 26. Vulnerabilities effectiveness -new approach EFFECTIVE VULNERABILITY proprietary code may call vulnerable code INEFFECTIVE VULNERABILITY proprietary code does NOT call vulnerable code
- 27. Based on testingof 2,000 Java applications… Over ten hours saved. Per developer. Per month. 70% 30% INEFFECTIVE EFFECTIVE 10.5 10
- 28. Usage analysis willeliminate 70%- 85% Of the vulnerabilities
- 29. 100% of theprojects found vulnerable 86% vulnerabilities are ineffective 36% projects are effective Impact-based Prioritization: Real-life Observations 90% in transitive dependencies
- 30. Takeaways 1. Open sourcecode is essential 2. 30% of the packages are vulnerable, and rising 3. Open source vulnerabilities are matters 4. If you can’t beat them - prioritize them
- 31. Practical tools TO BEAT opensource vulnerabilities 31
- 32. WhiteSource Bolt Free AzureDevOps Extension for Open Source Security For Azure DevOps
- 33. WhiteSource Bolt Fully integratedwithin Azure DevOps “We want Microsoft’s users to have access to the best industry solutions for open source management. That’s why we reached out to partner with WhiteSource.” Sam Guckenheimer, Group Product Planner, Microsoft
- 34. What is WhiteSourceBolt Find & Fix Open Source Vulnerabilities Detect vulnerable components & see actionable fix recommendations Generate Inventory Reports Ensure License Compliance Get a detailed BoM with all transitive dependencies Discover all used open source licenses in your project
- 35.
- 36. How Can ifix if i don’t know what i have?? 36
- 37. Generate Inventory report ●Automated Inventory reports ● Database of over 100M components & 70M source files ● Generating project and build level reports
- 38. Open source Outdatedreport
- 39. Find & FixVulnerabilities
- 40. Security DevOps Developers PRIORITIZATIONIS KEY TO OPEN SOURCE VULNERABILITY MANAGEMENT
- 41. The cost offixing security and quality issues is rising significantly, as the development cycle advances. Source: Ponemon Institute Research Coding $80/Defect Build $240/Defect QA & Security $960/Defect Production $7,600/Defect Detect Issues As Early As Possible
- 42. Find & FixVulnerabilities ● Over 200K vulnerabilities from multiple sources ● Actionable fix suggestions ● Accurate matching with no false positives
- 43. Fully integrated withdev environment
- 44.
- 45.
- 46. Open source components- Licenses ● GitHub - Repo
- 47. Open source components- Licenses ● GitHub - Tag Version 0.16 Version 1.4.4
- 48. Open source components- Licenses ● NpmJS
- 49. Open source components- Licenses ● Nuget
- 50.
- 51.
- 52. Ensure Licenses compliance ●Detection of components and dependencies' licenses ● Providing origin links for due diligence reports ● Generating project and build level reports
- 53.
- 54.
- 55. What Is WhiteSource? GetFull Visibility Throughout The SDLC Manage your entire pipeline, including your binary repositories, package managers, build tools and CI servers and container environments, covering over 200 languages. Enforce Policies Automatically to approve, reject, reassign or even open an issue ticket to get full control and automate current manual time-consuming tracking and approval processes. Effective Usage Analysis Prioritization tool that can reduce 70% of all security alerts by usage analysis technology Licenses Compliance Full visibility on all open source licenses in use4 3 2 1
- 56. WhiteSource Leads the Waywith the highest score for current offering and strategy in the latest Forrester Wave™ SCA Report. The Forrester Wave: Software Composition Analysis 2019
- 57.