The Devops Challenge: Open Source Security Throughout the DevOps Pipline- A WhiteSource Webinar
Download as PPTX, PDF18 likes209 views
This document discusses open source security challenges and recommendations for addressing them. It notes that over 96% of developers rely on open source components but open source vulnerabilities are rising. While companies prioritize fixes, over half do not do so efficiently based on real business impact. The document recommends integrating scanning for vulnerabilities into the entire software development lifecycle from code to deployment. Automating scanning, prioritization of issues, and remediation helps ensure open source security.
The Devops Challenge: Open Source Security Throughout the DevOps Pipline- A WhiteSource Webinar
- 2. Hello! Shiri Arad Ivtsan Product Manager @WhiteSource Shiri.ivtsan@WhiteSourceSoftware.com
- 5. Open Source 96.8%of the developers rely on open source components
- 6. Security in Open Source
- 7. Some Basic Statistics * Based on a survey conducted in more than 650 companies
- 8. OSS Security Vulnerabilities Are On The Rise 51% The observed YoY rise of reported vulnerabilities in 2017
- 9. Open Source Challenges Onechallenging area in particular is pronounced
- 10. Companies Do Not Prioritize Their Fixes Efficiently Criticality of the project that might be impacted by the vulnerability Availability of the suggested fix Perceived impact of the vulnerability on projects Number of software libraries containing the vulnerability Vulnerability severity Creation date of the vulnerability alert prioritize based on the real business impact ~56% Just
- 11. Recent News Integrity Availability Security-Protection
- 13. Security Throughout The SDLC Pipeline
- 14. Scan
- 15. CI/CD Pipeline Code Build Package Deploy
- 16. Code Code Build Package Deploy β’ Choose the right component from the earliest stages β’ Automatically open pull requests for patches β’ Restrict merges if vulnerabilities exist
- 17. Build Code Build Package Deploy β’ Scan on any build β’ Fail builds based on policies (i.e high severity vulnerabilities)
- 18. Package Code Build Package Deploy β’ Scan Docker images β in private and public image registries
- 19. Deploy Code Build Package Deploy β’ Scan upon deployment to your production platform β’ Monitor running applications in production for newly published vulnerabilities
- 20. Key Takeaways Know your code Monitor it frequently Make it simple & faster: Automate β’ Automate the scanning β’ Automate the prioritization β’ Automate your remediation