Static Analysis Helps DevOps Teams Maintain Velocity Securely
Static application security testing (SAST) is the process of examining source code for security defects. SAST is one of many checks in an application security assurance program designed to identify and mitigate security vulnerabilities early in the DevOps process. Integrating SAST tools into DevOps processes is critical to building a sustainable program. And automating these tools is also an important part of adoption, as it drives efficiency, consistency, and early detection.
But DevOps practitioners looking to integrate SAST tools into the DevOps pipeline often have questions:
- How do I manage false positives?
- How do I triage the results?
- What happens to new issues identified?
- How can I use a tool in my DevOps pipeline?
If you have questions like these, and you’re concerned about integrating SAST tooling into your DevOps process, this session will offer actionable advice to automate security testing that supports DevOps velocity.
RecordedOct 11 201861 mins
Your place is confirmed, we'll send you email reminders
And all that code needs to be secure. This presentation will discuss what happens when unsecured code on IoT/Embedded devices are released to the unsuspecting public and how the security industry (Synopsys) can help prevent this in the future. I will cover how the latest software development techniques can also incorporate the latest cutting edge tools to help eliminate security vulnerabilities before they make it to production. And finally how you can be a part of the solution instead of part of the problem.
Bryan Cross, Sr. Solutions Engineer, GitHub; Dave Meurer, Alliances Technical Mgr, Black Duck by Synopsys
It's time to add “Sec” into DevOps! But while moving towards newer processes and technologies like agile methodologies, cloud and containers can help you build faster and deliver continuously, there's always the fear that adding security can severely slow things down. By using GitHub with Black Duck by Synopsys, you can automate your secure development workflows, shift security left, and avoid software rot.
Whether you are an open source developer or enterprise software engineer, GitHub and Synopsys have solutions to help you put “Sec” into the center of DevOps without sacrificing speed and agility. In this live webinar, the experts from Synopsys and GitHub will demonstrate solutions for both open source and enterprise developers. Some highlights will include:
- The real life of a vulnerability in 2017: Apache Struts
- Black Duck CoPilot: It’s Free!
- Black Duck your Pull Requests
Lisa Bryngelson, Sr. Product Manager, Black Duck by Synopsys
Organizations of all kinds increasingly rely on third-party software from their supply chain partners and outsourcers to power the products and technology they deliver to the marketplace. Whether you’re an automotive company or a medical device manufacturer, use of third-party software libraries is now commonplace and essential to success in the competitive global marketplace.
One of the biggest challenges companies face with third-party software is they often have no visibility into the open source libraries being used in the software they embed in their products. Over the last year, a continuous stream of news stories has attributed major security breaches to exploits of vulnerabilities in open source frameworks used by Fortune 100 companies in education, government, financial services, retail and media.
These incidents shine a light on the need for organizations to carefully manage the open source used in the third-party libraries they consumer in order to protect themselves—and their customers—from the consequences of catastrophic security breaches.
Our webinar will arm you with the information and statistics needed to:
-Explain the importance of open source security to your organization
-Understand the key differences between identifying open source in source code vs. binaries
-Define a clear road map for unearthing, managing, and securing the open source hiding in your software supply chain
-Take the steps to help your company avoid becoming the next security breach media story
Application security is quickly becoming a "must have" for security teams. High profile breaches, including Equifax and a multitude of ransomware attacks, have the attention of senior management of company Boards. Knowing where to start can be difficult.
Not every company has the same needs or organizational maturity to manage a full-blown application security program. This webinar will cover some of the tools and exercises deployed by application security teams to build security into their processes, including:
- Tools and security tips for each phase of the development lifecycle
- Which tools to use for different types of code
- In-house and 3rd party options for starting an application security program
Tim Mackey, Sr. Technology Evangelist at Black Duck by Synopsys
Open source software is embraced by developers, enterprises, and governments at every level, and with it comes many strong opinions and few facts. How much open source is really being used in the applications you buy? Does the "many eyes" theory make open source more secure? Does traditional security testing address vulnerabilities in open source?
With organizations becoming more agile but facing increasing regulatory governance, understanding how open source software development works, and how to secure open source, is increasingly important. In this session we’ll cover:
- Code contribution and IP management
- Fork management
- Release process
- Security response processes
- Realities of IP risk and open source
- Pass through security risk and responsibility
- Keeping up with scope of impact changes within a single disclosure
- Automating awareness of security risk from development through integration and delivery to deployment
Elena Kvochko is the CIO for the Group Security Function within a leading financial services organization. Previously she was an information technology manager at World Economic Forum, where she led global partnership programs on cyber resilience and the Internet of Things. She was also responsible for building relationships with information technology industry partners. Elena is the author of numerous articles and has contributed to Forbes, the New York Times, Harvard Business Review, and other media outlets. She is also a member of the Wall Street Journal CIO Network. She holds full CISSP and CEH certifications and has a master’s degree in technology policy from the University of Massachusetts, as well as executive certificates from MIT and Yale. She lives in New York City.
Listen as Gary and Elena discuss security policy, security technology, the role of a CIO, holistic security tactics, the economics of a security breach, and more.
SAST, IAST, DAST, MAST, *AST – There are plenty of technologies and ways to test your software, but how do we do that without slowing us down in a rapid development environment. In this talk we will give practical advice on how to integrate software security testing into your CI/CD and your development process so it works. The talk will review the pros and cons of each of the testing technologies, and how to adapt it to rapid development, and how to manage the balance between risk and speed to build a proper signoff process, so that real threats will become blockers, but other issues will be handled in a parallel slower cycle, without slowing down the main delivery.
Craig Froelich is the chief information security officer (CISO) for Bank of America. He leads the Global Information Security team responsible for security strategy, policy, and programs. Before moving to Bank of America through acquisition, he was responsible for Countrywide’s cyber security technology, networks, crisis management, and security operations. Craig has over a decade of experience in product management and application development for software and hardware companies. He also serves on the board of FS-ISAC and the executive committee of BITS. On Twitter, he describes himself as “a SoCal dude learning to be a southern gentleman” as a Los Angeles transplant to Charlotte, North Carolina, where he lives with his family.
Listen as Gary and Craig discuss the role of the CISO in the financial services ecosystem and the newly released 2018 CISO Report.
Mark Radcliffe, Partner, DLA Piper/Counsel OSI; Phil Odence, Sr. Director / GM at Black Duck Software by Synopsys
Gain insights into these important legal developments from two of the leading open source legal experts, Mark Radcliffe, Partner at DLA Piper and General Counsel for the Open Source Initiative and Phil Odence, Sr. Director and General Manager at Black Duck Software by Synopsys. This annual review will highlight the most significant legal developments related to open source software in 2017, including:
- Current litigation
- An open source security update
- Blockchain and its forks
- Software Package Data Exchange (SPDX) and OpenChain
- And more
Live attendees will be receiving a CLE credit for this webinar.
Bruce Potter is CISO at Expel, where he is responsible for cyber risk and ensuring the secure operation of Expel’s services. Previously, Bruce co-founded Ponte Technologies (sold to KeyW Corporation). He then served as CTO at KeyW for 2 years. Before that, Bruce was a security consultant at Cigital. In a seemingly previous life, Bruce founded the Shmoo Group. To this day, he helps run the annual hacker conference ShmooCon. He has co-authored several books, including “802.11 Security,” “Aggressive Network Self-Defense,” and “Host Integrity Monitoring.” Bruce regularly speaks at DEF CON, Black Hat, and O’Reilly Security conferences. He lives in Maryland with his family.
Listen as Gary and Bruce discuss ShmooCon, the state of software security books, network security trends, hacking back, the relationship between preventative security engineering and operational security, DevOps, the CISO role, and more.
Mike Pittenger, VP Security Strategy, Black Duck Software
Vulnerabilities are an inevitable part of software development and management. Whether it’s open source or custom code, new vulnerabilities will be discovered as a code base ages. A 2017 Black Duck analysis of code audits conducted on 1,071 applications found that 97% contained open source, but 67% of the applications had open source vulnerabilities, half of which were categorized as severe. As the number of disclosures, patches, and updates grows, security professionals must decide which items are critical and must be addressed immediately and which items can be deferred.
Join Black Duck’s VP of Security Strategy, Mike Pittenger, for a 30-minute discussion of best practices in open source security and vulnerability management. You’ll learn:
- Methods for determining which applications are most attractive to attackers, and which pose the greatest risk
- Ways to assess the risk associated with a disclosed open source vulnerability
- Strategies to minimize the impact of open source security vulnerabilities when immediate fixes can’t be made
IT operations teams are now deploying and running hundreds or even thousands of containers at any given time. This rapid deployment surfaces challenges in validating the contents and security of container images being deployed. In this session, Black Duck container and virtualization expert Tim Mackey will provide an overview of technologies and solutions such as Red Hat OpenShift that enable organizations to deploy containers at scale securely.
In this webinar, Tim Mackey explores this new era of large scale container deployments and how to manage and secure them.
Attend and you'll learn:
- How to maintain visibility and control for the open source deployed in hundreds of containers
- How to help your development and operations teams work together to maintain the security of containers in production
- How to build security into your deployment of container orchestration platforms
- Measures you can take to proactively identify risks and remediate risks on containers in production
- How you can use Black Duck OpsSight to scan containers being created, updated or deployed through their container orchestration platforms
Stephen Elliott, Product Manager Google Container Registry and Dave Meurer, Director Technical Alliances
DevOps teams are using cloud platforms and containers to build, deploy, and manage applications faster than ever, and utilizing large amounts of open-source software to increase agility. Google Cloud platform makes building and shipping containers even easier with Google Container Builder, Google Container Engine (GKE), and Google Container Registry (GCR). But when you deploy a container or cloud-native application, it’s hard to know exactly what contents are inside, and that can make managing security painful.
Secure DevOps means having full visibility and control of your software supply chain to implement security and governance policies. How do you protect your DevOps without slowing down? Join experts from Google and Black Duck to discuss how to secure the software supply chain including:
- Understanding the modern attack landscape
- How to select safe and healthy open source software in development
- How you can automate open source control and visibility in containers with Black Duck and both Google Container Builder and GCR
- The Grafeas and Kritis projects, and the work Google and Black Duck are doing to enhance security visibility and provide policy enforcement for containers.
Phil Odence, Black Duck Software and David Tollen, Tech Contracts Academy
Join Black Duck and Tech Contracts Academy as they discuss the implications of open source software in tech contracts. The topic of open source has been at the forefront of the technology industry for many years, but as the use of open source in commercial applications explodes, so do concerns about addressing license and ownership issues in contract negotiations.
David Tollen is the founder of Tech Contracts Academy (www.TechContracts.com) and of Sycamore Legal P.C., in San Francisco. He’s the author of The Tech Contracts Handbook: Cloud Computing Agreements, Software Licenses, and Other IT Contracts for Lawyers and Businesspeople. He will dive into these topics from the perspective of both buyers and sellers and will aim to educate participants on Intellectual Property (IP) protection and other terms and how they should work during contract negotiations.
Bob Canaway, CMO, Black Duck; Mike Pittenger, VP Security Strategy, Black Duck
The Equifax breach provided a unique look into “how” many breaches occur. In Equifax’s case, hackers exploited an unpatched Apache Struts component, resulting in the exposure of over 140 million consumer records. The exploit of this vulnerability highlights the need for visibility to open source in custom applications and just how ineffective traditional security solutions are when it comes to open source vulnerabilities.
Further, while class action lawsuits have already begun, Equifax faces other regulatory challenges as well. The US Federal Trade Commission started investigations into the company’s security policies and controls that will likely result in financial penalties. Since the exposed data included non-US citizens, foreign data protection and data privacy regulations also come into play.
Join Mike Pittenger and Bob Canaway as they discuss how organizations can more effectively manage open source, the strengths and weaknesses of testing methodologies in identifying vulnerable open source components, and how data privacy standards such as PCI, Section 5 of the FTC Act, and GDPR necessitate a change in how organizations address vulnerabilities in their code.
What if you could test software for unknowns? You can with fuzz testing. Fuzz testing manipulates input data to send until the malformed input causes the software to crash. Our fuzzing solution provides pre-built test suites that eases the burden of manual black box test creation. And our fuzz testing solution runs on any VM or Windows or Linux computer to produce a detailed remediation package that helps identify and fix software issues fast.
Wouldn’t it be great to minimize the risks of 3rd party code? Introducing software composition analysis – or SCA -- from Synopsys. Our SCA solution quickly and accurately scans virtually any software package. It produces a bill of materials listing third-party components, their versions, and their location. And our SCA solution runs on either source code or binary, either as a managed service, or as an on premise virtual appliance, so that you always know for certain what’s in your software.
As the world's 16th largest software company, Synopsys has a history of being a global leader and was recognized by Gartner as a leader in software quality and security solutions. At Synopsys, we offer the most comprehensive solution for integrating security and quality into your SDLC and supply chain and work with over 1,500 industry-leading companies across all sectors including: 17 of the top 20 commercial banks 9 of the top 10 software companies 4 of top 5 managed healthcare firms 3 of top 4 US wireless providers By injecting software quality and security at the right time, at the right depth within your development environment, our software integrity platform promotes productivity and efficiency that empowers customers to develop secure, high-quality software. Our testing solutions improve the accuracy of findings, speeds up the delivery of results, and reduces the level of noise faced by developers.
How well do your security controls align with industry best practices? Software design flaws account for up to 50 percent of security vulnerabilities. If you are only checking for bugs in your code or running fuzz tests against your system you might still miss up to half of the security vulnerabilities in your software. Auditing controls, authorizations, and component updates are essential strategies to help reduce security flaws and lower your risk of a breach. But how do you know whether they are implemented correctly? Introducing Software Architecture and Design from Synopsys. Our experts evaluate the design of your key security controls against industry best practices to determine if any are misconfigured, weak, misused, or missing.
Do you know how well your organization's people, processes, and technologies can withstand a real-life cyberattack? What level of access and information that an attacker might gain? Personal Identifying Information, Personal Account Number, or corporate intellectual property. What damage might a severe data breach cause? What harm such an attack might bring to the organization’s brand and reputation? Introducing Red Teaming from Synopsys. Red Teaming simulates an attack on the client’s organization to measure how well their people, process, and technologies can withstand a real-life attack situation.
We go beyond traditional application testing to empower you to build security into your software at every stage of your development process. We offer application testing and remediation expertise, guidance for structuring a software security initiative, training, and professional services for a proactive approach to application security.