Sonatype Software Supply Chain 2017 - JAVA Users Group
- 1. Tampa JAVA Users Group May 2017 Ravi Lachhman – JAR Wrangler
- 2. 1 COMPANIES DON’T WRITE; 2 3 SOFTWARE ANYMORE;
- 4. Utilizing billions of parts from open source communities... 80% to 90% of modern apps consist of assembled components.
- 5. “You cannot inspect quality into a product.” W. Edwards Deming Out of the Crisis 1982 5
- 6. THE BEST ARE BORROWING FROM DEMING
- 7. NOT ALL PARTS ARE CREATED EQUAL
- 8. Say Hello to Your Software Supply Chain…
- 9. 1,152 new projects per day 10,000 new versions per day 14x releases per year
- 10. THE SSC INDEX Open Source Component Download Requests, The Central Repository, 2008 - 2016
- 11. DOWNLOAD RECORDS FOR 2014 2015 2016 4.6 BILLION 22.5 59.0
- 12. DOCKER HUB DOWNLOADS 1,000,000,000 2014 2015 2016 3,000,000,000 6,000,000,000 9,000,000,000 12,000,000,000 2017 2014 1M PULLS 2015 1B PULLS 2016 6B PULLS 2017 12B PULLS Source: DockerCon 2017 Keynote
- 13. 2014 2015 2016 5.5%6.1%6.2% DEFECT DOWNLOAD RATIO FOR JAVA COMPONENTS
- 14. 125,701 downloads orders 3,185 components - all versions parts 1,346 components suppliers Analysis of 7,500 organizations
- 15. 125,701 downloads Analysis of 7500 organizations 7,248 5.8% known security vulnerabilities
- 16. Warehouses Manufacturers Finished Goods 6.1% component downloads are vulnerable 5.6% components in repository managers are vulnerable 6.8% components in applications are vulnerable
- 17. DEFECT RATIO FOR JAVASCRIPT Source: Thou Shalt Not Depend on Me: Analyzing the Use of Outdated JavaScript Libraries on the Web, © 2017 NDSS, Northeastern University 87% of handlebars inclusions were known vulnerable 37% of jQuery inclusions were known vulnerable 40% of Angular inclusions were known vulnerable 37% websites include at least one library with a known vulnerability
- 18. Source: 2014 Sonatype Open Source Development and Application Security Survey, and Sonatype’s 2017 DevSecOps Community survey ALMOST 4-IN-10 RUN WITHOUT AN OPEN SOURCE POLICY Q: Does your organization have an open source policy? 2014 2017 57% YES 58% YES
- 19. NEWER COMPONENTS MAKE BETTER SOFTWARE Analysis of components in 25,000 applications scans COMPONENTS BY YEAR DEFECT DENSITY 1 2 3 4 5 6 7 8 9 10 11 5% 10% 15% 20% 25% Component Age in Years 3X HIGHER DEFECT DENSITY
- 20. OLDER COMPONENTS DIE OFF Analysis of components in 25,000 applications scans INACTIVE PROJECTS (% on latest version) 1 2 3 4 5 6 7 8 9 10 11 5% 10% 15% 20% 25% Component Age in Years
- 23. 18,330,958 78% downloads were vulnerable COMMONS COLLECTION CWE-502 23,476,966 total downloads in 2016
- 24. 2,731 organizations downloaded the vulnerable versions. STRUTS2 CVE-2017-5638 279,796 total downloads in 2016 Image Source: Canadian Revenue Agency, Wikipedia
- 26. ZTTR (Zero Time to Remediation) EMPOWER DEVELOPERS FROM THE START @weekstweets
- 27. Create your own for free at bit.ly/softwareBOM @sonatype CREATE A SOFTWARE BILL OF MATERIALS