Explore the complexities of open source software risks in this 22-minute conference talk from Conf42 DevOps 2024. Delve into topics such as software dependencies, open source vulnerabilities, and prioritization strategies. Learn about tools like Semgrep Supply Chain and Software Composition Analysis for managing risks. Discover reachability analysis, remediation techniques, and the importance of semantic versioning. Gain practical insights on handling manifest files, dependency versions, and transitive vulnerabilities. Walk away with key takeaways and valuable resources to enhance your DevOps practices and mitigate open source software risks effectively.
Mapping the Minefield of Open Source Software Risks - DevOps 2024
Overview
Syllabus
intro
preamble
about kyle
agenda
software dependencies
open source software oss
oss vulnerabilities
an uncomfortable prioritization exercise
semgrep supply chain ssc
software composition analysis sca
one of a few ways: reachability
now what? remediation
easy wins with semantic versioning semver
manifest file dependency versions
example
transitive vulnerabilities
key takeaways
resources
Taught by
Conf42
Related Courses
-
Prioritisation of SCA Findings in Software Dependencies Using Static Reachability Analysis
-
The Devils in the Dependency - Data Driven Software Composition Analysis
-
Practical Approach to Automate the Discovery and Eradication of Open-Source Software Vulnerabilities
-
OWASP Dependency Track - Fortifying the Software Supply Chain
-
The Hidden Risks of Software Reuse - OWASP Top 10 Open Source Software Risks
-
Fresh SLSA and GUAC - Understanding Open Source Package Risks and Transparency
