It’s no secret that open source components form the backbone of today’s software, comprising between 60-80% of modern applications. But with this, comes the alarming rise in open source vulnerabilities – more than 3,500 open source vulnerabilities were reported in 2017 – that’s 60% higher than the previous year, and the trend continued in 2018. The question arises: how can DevOps teams ensure a visible and continuous delivery pipeline for software releases without letting security slow them down? Join WhiteSource’s Product Manager, Shiri Ivtsan, as she discusses: - The current state of open source vulnerabilities management; - The latest innovations in the open source security world; and - The best DevOps tools to protect organizations against open source vulnerabilities and ensure agility, visibility and control regarding their open source.

1. Open Source Security at Scale
The DevOps Challenge

2. Hello!
Shiri Arad Ivtsan
Product Manager @WhiteSource
Shiri.ivtsan@WhiteSourceSoftware.com

3. Continuous Delivery

4. Continuous Delivery

5. Open Source
96.8%of the developers rely on
open source components

6. Security in Open Source

7. Some Basic Statistics
* Based on a survey conducted in more than 650 companies

8. OSS Security Vulnerabilities Are On The Rise
51%
The observed YoY rise
of reported vulnerabilities in 2017

9. Open Source Challenges
Onechallenging area in particular
is pronounced

10. Companies Do Not Prioritize Their Fixes Efficiently
Criticality of the project that might be impacted by the vulnerability
Availability of the suggested fix
Perceived impact of the vulnerability on projects
Number of software libraries containing the vulnerability
Vulnerability severity
Creation date of the vulnerability alert
prioritize based on the real business
impact
~56%
Just

11. Recent News
Integrity Availability Security-Protection

13. Security Throughout The
SDLC Pipeline

14. Scan

15. CI/CD Pipeline
Code Build Package Deploy

16. Code
Code Build Package Deploy
• Choose the right component from the earliest
stages
• Automatically open pull requests for patches
• Restrict merges if vulnerabilities exist

17. Build
Code Build Package Deploy
• Scan on any build
• Fail builds based on policies (i.e high severity
vulnerabilities)

18. Package
Code Build Package Deploy
• Scan Docker images – in private and public
image registries

19. Deploy
Code Build Package Deploy
• Scan upon deployment to your production
platform
• Monitor running applications in production for
newly published vulnerabilities

20. Key Takeaways
Know your code
Monitor it frequently
Make it simple & faster: Automate
• Automate the scanning
• Automate the prioritization
• Automate your remediation

21. Q&A