Software Composition Analysis Courses and Certifications

DevSecOps Fundamentals - Including Hands-On Demos

1453 ratings at Udemy

The complete course covering what you need to know to get started in DevSecOps and exactly how to do it!

• Udemy
• 5 hours 58 minutes
• On-Demand
• Paid Course

Inspecting Open Source Software Packages for Security and License Compliance

24 ratings at Pluralsight

This course will teach you about the inherent risks with leveraging open source libraries and components in your solutions, and how you can mitigate those risks using a software composition analysis tool, called WhiteSource Bolt, to scan your code.

• Pluralsight
• On-Demand
• Free Trial Available

Learn to integrate security into DevOps, covering vulnerabilities, tools for code analysis, and best practices. Gain skills to implement secure software development throughout the entire pipeline, from planning to deployment and monitoring.

• Cybrary
• 4-5 hours
• On-Demand
• Paid Course

NDC Conferences

Protect Yourself Against Supply Chain Attacks

Explore supply chain attack vectors, from CI/CD pipeline vulnerabilities to package squatting, and learn protective measures for securing your development environment.

• YouTube
• 1 hour 2 minutes
• On-Demand
• Conference Talk

Black Hat

The Devils in the Dependency - Data Driven Software Composition Analysis

Análisis de datos sobre el uso de bibliotecas de código abierto en aplicaciones, examinando vulnerabilidades, dependencias y patrones de actualización para mejorar la seguridad del software.

• YouTube
• 38 minutes
• On-Demand
• Conference Talk

Black Hat

Effective Vulnerability Discovery with Machine Learning

Explore machine learning techniques for effective vulnerability discovery in software dependencies, enhancing security analysis beyond traditional methods.

• YouTube
• 27 minutes
• On-Demand
• Conference Talk

Devoxx

Open Source Supply Chains and Consumption Risk Governance - Containers & Trust

Explore secure container deployments, open source security, and risk management in modern software development. Learn best practices for minimizing vulnerabilities and ensuring trust in large-scale applications.

• YouTube
• 43 minutes
• On-Demand
• Conference Talk

NDC Conferences

Application Security from Start to Finish

Comprehensive guide to integrating security throughout the development process, covering secure environments, dependency management, vulnerability scanning, and advanced testing techniques.

• YouTube
• 46 minutes
• On-Demand
• Conference Talk

Fission

Towards Intelligent Application Security

Exploring the evolution of application security and proposing an automated approach integrating security into development and operations, aided by learning techniques and threat intelligence.

• YouTube
• 52 minutes
• On-Demand
• Free Video

OWASP Foundation

Software Bill of Materials (S-BoM) - Reducing Risk in Third-Party Components

Explore best practices for managing third-party component risks using software bill-of-materials (S-BoM). Learn to create S-BoMs, identify vulnerabilities, and automate security responses in polyglot environments.

• YouTube
• 36 minutes
• On-Demand
• Free Video

OWASP Foundation

Software Supply Chain Lifecycle Management: Reducing Attack Vectors and Enabling Rugged DevOps

Exploring software supply chain lifecycle management to reduce attack vectors and enable rugged DevOps, focusing on IoT security, third-party software risks, and standards-based automation for threat detection.

• YouTube
• 52 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

SBOM: The Rest of the Story - Understanding Software Bill of Materials

Experts discuss Software Bill of Materials (SBOM), addressing misconceptions, sharing challenges, and exploring implementation strategies for enhanced software supply chain security.

• YouTube
• 27 minutes
• On-Demand
• Free Video

CNCF [Cloud Native Computing Foundation]

Securing Open Source Software Supply Chain - Continuous Secure Software Ingestion

Explore secure OSS ingestion in enterprises using Continuous Secure Software Ingestion (CSSI) application, built on Tekton & Open Policy Agent, for automated artifact grooming and policy-driven security checks.

• YouTube
• 26 minutes
• On-Demand
• Free Video

Hack in Paris

Building Systems on Shaky Grounds - 10 Tactics to Manage the Modern Supply Chain

Explore 10 tactics for managing modern software supply chains, balancing open-source benefits with security risks. Learn to assess vendors, conduct red team exercises, and implement effective incident response strategies.

• YouTube
• 42 minutes
• On-Demand
• Conference Talk

LASCON

Introduction to Inner-Loop Security - Shifting Left, but Better

Explore inner-loop security as the next evolution of "shift left," enabling developers to build secure-by-design products through improved methodologies and tools.

• YouTube
• 50 minutes
• On-Demand
• Free Video