Tsaela Pinto, Director of Knowledge R&D at WhiteSource, spoke at the Azure DevOps meetup in Tel Aviv about how develpers should part in maintaining open source security

1. Winning Open Source vulnerabilities
Without Loosing your developers
WhiteSource Software Internal and Proprietary
Tsaela Pinto
Director of Knowledge R&D

2. World’s
TOP
Open source
Knowledge
Base
2

3. Recent insights
Open source
vulnerabilities
are on the rise
Vulnerabilities handling
is inefficient
Prioritization
is the key
Usage analysis might
reduce alerts by 70% to
85%

4. Reported open source security
vulnerabilities are on the rise

5. 5

6. 6
CVE-2017-5638

7. 7
CVE-2017-5638

8. 8
If they knew how
it was going
to change
their
lives...

10. Heartblee
d
Stagefright
Shellshock
POODLE
Celebrities vulnerabilities
in OpenSSL in Bash
in Android operating system
in SSL 3.0
protocol

11. And it’s rising
51%the observed YoY rise
of reported vulnerabilities in 2017

12. 96%of the developers are relying on
open source components
>
Affected developers

13. A lot of Vulnerable projects
32%of the top 100 open source
projects
have been reported with a
vulnerability

14. 14

15. Most of them are already fixed
97%of the reported vulnerabilities
have a suggested fix

16. 16

17. 17

18. Where can we find them?
Just 86%
Are in the NVD

19. The Handling of Vulnerabilities
Is inefficient

20. Top Challenge in using open source component
One challenging area is
1VULNERABILITIES

21. How much time is spent?
None
1 - 10 hours
11 - 20 hours
21 - 35 hours
36 - 60 hours
Over 60 hours
15 hours/month
spent on average by every developer
on security vulnerabilities

22. What are the common tasks?
99%appear responsive
and reactive…
Nothing
Research to better understand the vulnerability and its impact
Remediate based on the open source community recommendation
Report to the other teams (Security/DevOps) or a manager
Remediate only through patches (if available)

23. Prioritization Is the key

24. Common prioritization methods
Criticality of the project that might be impacted by the vulnerability
Availability of the suggested fix
Perceived impact of the vulnerability on projects
Number of software libraries containing the vulnerability
Vulnerability severity
Creation date of the vulnerability alert
56 %
opt for
security/business-oriented
prioritization

25. Vulnerabilities are not Necessarily EFFECTIVE

26. Vulnerabilities effectiveness - new approach
EFFECTIVE VULNERABILITY
proprietary code may call
vulnerable code
INEFFECTIVE VULNERABILITY
proprietary code does NOT call
vulnerable code

27. Based on testing of 2,000 Java applications…
Over ten hours saved. Per developer. Per month.
70% 30%
INEFFECTIVE
EFFECTIVE
10.5
10

28. Usage analysis will eliminate 70%-
85%
Of the vulnerabilities

29. 100% of the projects found vulnerable
86% vulnerabilities are ineffective
36% projects are effective
Impact-based Prioritization: Real-life Observations
90% in transitive dependencies

30. Takeaways
1. Open source code is essential
2. 30% of the packages are vulnerable, and rising
3. Open source vulnerabilities are matters
4. If you can’t beat them - prioritize them

31. Practical tools
TO BEAT
open source
vulnerabilities
31

32. WhiteSource Bolt
Free Azure DevOps Extension for
Open Source Security
For Azure DevOps

33. WhiteSource Bolt
Fully integrated within Azure DevOps
“We want Microsoft’s users to have
access to the best industry solutions
for open source management. That’s
why we reached out to partner with
WhiteSource.”
Sam Guckenheimer, Group Product
Planner, Microsoft

34. What is WhiteSource Bolt
Find & Fix Open Source
Vulnerabilities
Detect vulnerable
components & see
actionable fix
recommendations
Generate Inventory
Reports
Ensure License
Compliance
Get a detailed BoM
with all transitive
dependencies
Discover all used
open source
licenses in your project

35. Generate Inventory report

36. How Can i fix if
i don’t know
what i have??
36

37. Generate Inventory report
● Automated Inventory reports
● Database of over 100M components & 70M source files
● Generating project and build level reports

38. Open source Outdated report

39. Find & Fix Vulnerabilities

40. Security DevOps Developers
PRIORITIZATION IS KEY TO OPEN SOURCE
VULNERABILITY MANAGEMENT

41. The cost of fixing security and quality issues is rising significantly,
as the development cycle advances.
Source: Ponemon Institute Research
Coding
$80/Defect
Build
$240/Defect
QA & Security
$960/Defect
Production
$7,600/Defect
Detect Issues As Early As Possible

42. Find & Fix Vulnerabilities
● Over 200K vulnerabilities from multiple sources
● Actionable fix suggestions
● Accurate matching with no false positives

43. Fully integrated with dev environment

44. Suggested fixes

45. Ensure licenses compliance

46. Open source components - Licenses
● GitHub - Repo

47. Open source components - Licenses
● GitHub - Tag
Version 0.16 Version
1.4.4

48. Open source components - Licenses
● NpmJS

49. Open source components - Licenses
● Nuget

50. Licenses - overview

51. Is licensing matters?

52. Ensure Licenses compliance
● Detection of components and dependencies' licenses
● Providing origin links for due diligence reports
● Generating project and build level reports

53. Licenses inventory report

54. Azure lab
54
https://www.azuredevopslabs.com/labs/vstsextend/whitesource/

55. What Is WhiteSource?
Get Full Visibility Throughout The SDLC
Manage your entire pipeline, including your binary repositories, package managers,
build tools and CI servers and container environments, covering over 200 languages.
Enforce Policies Automatically to approve, reject, reassign or even open an issue
ticket to get full control and automate current manual time-consuming tracking and
approval processes.
Effective Usage Analysis
Prioritization tool that can reduce 70% of all security alerts by usage analysis technology
Licenses Compliance
Full visibility on all open source licenses in use4
3
2
1

56. WhiteSource Leads
the Way with the
highest score for current
offering and strategy in
the latest Forrester
Wave™ SCA Report.
The Forrester Wave:
Software Composition Analysis 2019

57. THANK YOU
57
Tsaela Pinto
tsaela.pinto@whitesourcesoftware.com