Hi [[ session.user.profile.firstName ]]

Managing Open Source in Application Security and Software Development Lifecycle

Today, open source comprises a critical component of software code in the average application, yet most organizations lack the visibility into and control of the open source they’re using. A 2016 analysis of 200 commercial applications showed that 67% contained known open source vulnerabilities. Whether it’s a SaaS solution you deliver to millions of customers, or an internal application developed for employees, addressing the open source visibility and control challenges is vital to ensuring proper software security.
Open source use is ubiquitous worldwide. It powers your mobile phone and your company’s most important cloud application. Securing mission critical applications must evolve to address open source as part of software security, complementing and extending the testing of in-house written code.
In this webinar by Cigital and Black Duck security experts, you’ll learn:
- The current state of application security management within the Software Development Lifecycle (SDLC)
- New security considerations organizations face in testing applications that combine open source and in-house written software.
- Steps you can take to automate and manage open source security as part of application development
Recorded Sep 15 2016 55 mins
Your place is confirmed,
we'll send you email reminders
Presented by
John Steven, CTO, Cigital; Mike Pittenger, VP Security Strategy, Black Duck
Presentation preview: Managing Open Source in Application Security and Software Development Lifecycle
  • Channel
  • Channel profile
  • Why Software Composition Analysis is Critical to Secure DevOps May 16 2017 3:00 pm UTC 60 mins
    Amy DeMartine, Forrester Principal Analyst; Patrick Carey, Black Duck
    Open source software is the lifeblood of today’s enterprise applications, comprising 80%-90% of the code. However, open source use comes with significant security and IP risks that both enterprise and smaller organizations are ill-prepared to address.

    As development teams increasingly automate the software development lifecycle (SDLC) through the use of agile DevOps tools and practices, the need to mitigate these risks through integration of Software Composition Analysis (SCA) into the DevOps tool chain has become critical.

    In this webinar, Forrester Principal Analyst Amy DeMartine, and Black Duck Director of Product Marketing Patrick Carey, will discuss findings from the recent Forrester Wave report for Software Composition Analysis and why SCA should be a key part of your Secure DevOps strategy.

    The discussion topics will include:
    - Why you need a software composition analysis (SCA) solution
    - How SCA solutions help you manage open source vulnerability, compliance, and component quality risks
    - Criteria to consider when selecting an SCA solution
    - Why it's important to integrate SCA into your automated DevOps environment
  • Leveraging Reporting Improvements and Docker Scanning using Hub 3.6 May 11 2017 3:00 pm UTC 60 mins
    Pat Durante, Senior Director Education Services; John Beaudoin, Senior Instructional Designer
    Please join us for the next Black Duck Customer Success Webinar and learn about the features and enhancements in the latest Hub release – version 3.6. It includes new usability and project management improvements as well as administration and integration enhancements.

    We’ll discuss:

    - Leveraging the new Hub Reporting Database to programmatically access project, project version, component version, and component license data for custom data reporting and analysis.
    - Taking advantage of the new Print View option which displays the Bill of Materials in a format suitable for easy printing or exporting.
    - Adding subprojects to your Bill of Materials. For example, if you have projects used by other applications, you can add them to a BOM so that the BOM accurately reflects the elements in your application.
    - Using the updated Hub 3.6 Scan Client to scan Docker Images. We’ve introduced a new script, bundled with the Hub Scanner, to scan your Docker images for open source.
  • Audits of 1000 Apps: The Good, the Bad and the Ugly of Open Source Use May 4 2017 3:00 pm UTC 60 mins
    Mike Pittenger, VP Security Strategy, Black Duck Software
    Open source components are the foundation of today’s applications. Ineffective security and management of open source is pervasive.
    That stark contrast marks Black Duck’s recently released 2017 Open Source Security and Risk Analysis (OSSRA), which is based on code audits of more than 1000 applications. Not surprisingly, 97% of the audited applications contained open source. Disturbingly, 67% of the applications contained known open source vulnerabilities.
    In this webinar, Black Duck VP of Security Strategy Mike Pittenger will review the audit findings in depth and discuss strategies companies can use to minimize open source security risk while maximizing the economic and productivity value open source provides.
  • Assessing Open Source Risk: An Imperative for M&A Professionals Recorded: Apr 19 2017 59 mins
    Phil Odence, Vice President & General Manager On-Demand Audits; Mike Pittenger, VP Security Strategy
    Open source software use is ubiquitous worldwide, increasing the importance that M&A professionals understand the potential security, license compliance, and operational risks open source represents in today’s transactions.

    This webinar will detail findings in a recent report issued by Black Duck’s Center for Open Source Research and Innovation (COSRI) showing that most M&A target organizations are not effective in securing and managing their open source.

    Black Duck On-Demand audits hundreds of commercial code bases each year. The Open Source Security and Risk Analysis (OSSRA) will provide insight and results from over 1000 audits performed in 2016, including:

    - The number, age and severity of vulnerabilities in the open source components
    - The gap between the number of open source components used versus what the target company thought it was using
    - The prevalence of open source components using licenses that could put IP at risk
  • Before You Outsource, Protect Your IP & Mitigate Open Source Risks Recorded: Apr 18 2017 60 mins
    Jim Markwith, Managing Partner at Symons Markwith LLP
    Today’s rapidly changing technologies, including the proliferation of open source and the accelerating shift to the cloud, are increasing the use of outside experts for both application development and IT solutions. At the same time, IP security is top of mind worldwide. This presentation will look at ways organizations can outsource to meet their development needs and also address open source security and management risks before giving contractors access to their valuable technologies.

    Jim's bio:

    Jim Markwith is an experienced technology and corporate transactions attorney with over 20 years of experience. His clients range from start-ups to fortune 50 technology leaders, including computer software, on-line retail, and Healthcare IT product and service developers. Prior to private practice, Jim held Executive and Senior in-house legal positions with Microsoft, Adobe Systems, and Allscripts Healthcare. Jim received his J.D. degree from Santa Clara University School of Law, and is a member of the California, Washington, DC, and Washington State Bar Associations.

    For more information on Jim, please click http://symonsmarkwith.com/jim-markwith. For questions about this presentation, or for more information on available legal support, please contact Jim at jim@symonsmarkwith.com.
  • Comprehensive Toolkit Required for Application Security Recorded: Apr 13 2017 47 mins
    Mike Pittenger, VP Security Strategy, Black Duck
    Applications are the primary target for hackers with a staggering 84% of cybersecurity attacks focused on the application layer. Without effective tools to find and fix application security vulnerabilities, your organization is at risk. However, with lots of available tools – from Dynamic Analysis Security Testing (DAST) and Static Analysis Security Testing (SAST) to Open Source Security Vulnerability Management – selecting the right ones to ensure effective application security is a challenge.

    This webinar will provide an overview of application security risks, the types of solutions available, and where each excels or falls short. You will learn how to assemble a comprehensive application security toolkit to help you stay secure throughout the software application development and management lifecycle.
  • Litigating Open Source – Lessons learned from Hellwig and McHardy Recorded: Mar 23 2017 62 mins
    Mark Radcliffe, DLA Piper; Bernd Siebers, DLA Piper, Phil Odence, Black Duck
    The next wave of open source compliance challenges is upon us. Historically, enforcement has been a community based effort with an emphasis on “doing the right thing”. In recent years, however, we have seen the emergence of private enforcement and enforcement driven by entities and individuals for purposes of economic gain. In some cases these actions are to enforce legitimate interests arising from, for instance, dual licensing models. In other cases, copyright “trolls” are pressing an agenda. In this webinar, Mark Radcliffe and Bernd Siebers will review some of the current litigation trends, evaluate how the different elements of the open source community are reacting to these trends and offer insights and strategies for avoiding the cross-hairs. This includes taking a closer look at open source cases litigated in 2016 in Germany, including the following questions:

    - Are we experiencing a shift in jurisprudence?
    - What should users and developers of open source software do to protect themselves?
    - What's the contribution of the open source community?
  • The Case for Continuous Open Source Management Recorded: Mar 22 2017 45 mins
    Bob Genshaft, Wolters Kluwer; Phil Odence, Black Duck Software
    Companies are constantly seeking ways to ensure their application code is secure and effectively managed. For example, M&A acquirers conduct one-time code audits on companies they are buying to avoid legal, operational or security pitfalls. Other organizations are proactive, using an ongoing solution to make sure their application code is secure and well managed on a day-to-day basis. Increasingly, many companies are opting to use both approaches.

    Join Bob Genshaft, Director Strategic Programs at Wolters Kluwer, and Black Duck's VP and General Manager On-Demand Audits Phil Odence for a discussion that will address key open source security and management questions:

    · When is it appropriate to conduct an audit?
    · When should your company consider an ongoing solution?
    · What are the benefits of doing both?
  • Effectively Managing Enterprise Application Security: A Proverbial High-Wire Act Recorded: Mar 8 2017 56 mins
    Constantine Grancharov - IBM, Mike Pittenger - Black Duck Software
    Enterprises face an array of application security challenges that impact their risk profiles, revenue streams, operational continuity, development agility and legal exposure.

    What’s your plan of action when a security breach or critical vulnerability can’t be fixed quickly? How do you remediate application security issues with the least impact on operations and revenue, and what are the legal implications if you can’t? How do you effectively manage application security and maintain agility in a multi-stream, DevOps environment? And, do you really understand what your application security risk profile is?

    Experts from IBM and Black Duck will address these questions in our webinar. We’ll also share the latest research and best practices that global organizations are using to minimize application security risks. You’ll learn:

    - Innovative application security practices large enterprises use for DevOps and Continuous Integration environments
    - Scalable approaches to designing application testing for different agile-development pipelines
    - Best practices for minimizing the impact of security vulnerabilities when immediate fixes can’t be made.
  • Reducing Open Source Risk and Remediation Costs Early in the SDLC Recorded: Feb 22 2017 74 mins
    Pat Durante, Senior Director Education Services; John Beaudoin, Senior Instructional Designer
    Increasingly, organizations worldwide are implementing open source security and license risk assessment capabilities early in the software development lifecycle when the cost to remediate issues is lowest. This webinar will demonstrate Black Duck Hub’s effectiveness in providing comprehensive risk assessments when used in combination with our Eclipse IDE plugin, Build Tool, and CI Tool integrations. Additionally, we'll review valuable new features in Black Duck Hub 3.5.
    You’ll also learn:
    - How to improve the accuracy of your open source inventory by leverage open source dependency discovery techniques for build tools and package managers
    - Options for incorporating Hub scanning into your Continuous Integration environments
    - How to track remediation tasks using the Hub-Jira integration
    - How to streamline your component review process
    - Use cases for scanning binary repositories such as Artifactory
  • The 2016 Open Source Year in Review Recorded: Feb 1 2017 61 mins
    Karen Copenhaver, Partner, Choate Hall & Stewart/Counsel, Linux Foundation; Mark Radcliffe Partner, DLA Piper/Counsel OSI
    This annual review will highlight the most significant legal developments related to open source software in 2016, including:
    - Current litigation
    - An open source security update
    - Companies open sourcing their own code
    - FCC banning open source in routers
    Gain insights into these important legal developments from two of the leading open source legal experts, Karen Copenhaver, Partner at Choate Hall & Stewart and Counsel for the Linux Foundation, and Mark Radcliffe, Partner at DLA Piper and General Counsel for the Open Source Initiative.
  • Risk-Ranking Open Source Vulnerabilities Recorded: Jan 19 2017 43 mins
    Mike Pittenger, VP Security Strategy, Black Duck
    Increase security effectiveness and maintain dev agility

    Three certainties in 2017: organizations worldwide will continue to increase their use of open source software; new open source security vulnerabilities will be discovered; exploits of open source vulnerabilities will occur.

    With dev teams under constant pressure to accelerate application delivery and with security resources often scarce, organizations need more effective ways to determine which open source vulnerabilities to fix first and the options available to reduce risk during remediation.

    Join Black Duck VP of Security Strategy Mike Pittenger as he discusses strategies and emerging best practices for risk-ranking open source vulnerabilities. He will cover:
    - the most important considerations in prioritizing open source security issues
    - ways to determine the risk associated with a discovered open source vulnerability
    - options for dealing with open source security vulnerabilities beyond simply replacing the component
  • AppSec in 2017 – A Look into the Future Recorded: Dec 13 2016 59 mins
    Poonam Yadav, Product Manager, HPE Security Fortify; Mike Pittenger, VP of Security Strategy, Black Duck
    Application security broke new ground in 2016. The shift to DevOps has driven the need for new technologies and different levels of integration across the development ecosystem. The focus is pulling all your organization’s technologies together and bring in products that easily and seamlessly fit into any environment, thereby further automating security while maintaining development agility. These enhancements deliver a more complete view of application-security health, making it possible to assess Static, Dynamic, Interactive and Open Source security in a single view.
    Advancements have been made but as we’ve learned, application security is ever changing. New technology trends – container adoption, IoT, for example – mean new security considerations and AppSec innovation must continue in 2017.

    In this webinar presented by experts from HPE Security Fortify and Black Duck, you'll learn about:

    - The major AppSec advancements in 2016 and their impact on software security health
    - New ways AppSec will evolve in the coming year, including the areas of remediation improvement and cloud integration, DevOps, and Continuous Integration
    - Check list of AppSec best practices for your 2017 toolbox
  • Got Open Source Questions? Get Practical, Actionable Advice from the Experts. Recorded: Dec 7 2016 60 mins
    Karen Copenhaver, Partner, Choate Hall & Stewart/Counsel, Linux Foundation; Mark Radcliffe Partner, DLA Piper/Counsel OSI
    Despite open source software's long history - Linux just turned 25 - legal and risk questions about open source use still abound. Black Duck On-Demand Vice President & General Manager Phil Odence regularly fields open source-related questions as he speaks with tech executives and their counsel. Listen in as Phil goes through some of the most frequently asked questions and gets expert answers from Attorneys Karen Copenhaver and Mark Radcliffe. Both are well versed in the legal nuances of open source, and are able to turn their expertise into practical, actionable advice as they ably demonstrate in this webinar.
  • 5 Ways Black Duck Hub Can Improve Open Source Security & Compliance Recorded: Dec 6 2016 54 mins
    Pat Durante, Senior Director Education Services; John Beaudoin, Senior Instructional Designer; Dave Gruber, VP of Product
    During our next customer webinar, we’ll share expert tips and best practices on how to extract maximum value from the latest features available in Black Duck Hub. The new integrations and features help improve both open source security and compliance. You’ll learn how to:

    •Track remediation tasks using the new Hub-Jira integration
    •Leverage new open source discovery techniques for Ruby Gems and Node.js as well as build integrations for Maven/Gradle to improve the accuracy of your open source inventory
    •Customize your notices file so that all open source is properly attributed
    •Leverage the new Hub-Email Extension to push notifications via email
    •Incorporate Hub scanning into your Jenkins pipeline projects
  • The State of Open Source Security Recorded: Nov 30 2016 56 mins
    Bob Canaway, CMO, Black Duck
    Open Source software is the foundation for application development today and its use is growing rapidly worldwide because of the development cost reductions and innovation it enables. Black Duck discovers open source in every application it analyzes and finds finds that 35% of the average commercial software application is open source. Home-grown applications typically contain 50% or more open source.

    The dramatic growth in open source use has been accompanied by an array of security and management challenges related to a lack of visibility into and control of the open source in use. Leading organizations are aggressively pursuing ways to continue to increase their use of open source and do so without compromising effective security or management.

    This webinar will present findings from Black Duck's Center for Open Source Research examining open source use, risks, and benefits. Black Duck CMO Bob Canaway will discuss the latest open source threats, usage patterns, governance, and the changing security and management needs as open source expands across the cloud, the Internet of Things, and the digital landscape.
  • Top 5 Open Source Issues - Stories from the M&A Trenches Recorded: Nov 16 2016 59 mins
    Jim Markwith, Managing Partner at Symons Markwith LLP
    Open source risk is a significant issue for both buyers and sellers in M&A transactions. Although open source comprises 30-50% of the code in an average application, results from Black Duck open source audits are eye-opening: sellers rarely know what open source they’re using and there are often serious risks associated with open source components in code assets.

    In this webinar, Jim Markwith, a technology attorney who handles complex IP licensing transactions, and has been involved in scores of M&A deals, will discuss the top five open source issues that impact transactions. He will provide in-depth descriptions of the challenges encountered and their impact on the transaction, punctuating the presentation with insightful stories from the M&A trenches.
  • Myths and Misperceptions of Open Source Security Recorded: Nov 10 2016 41 mins
    Mike Pittenger, VP of Security Strategy, Black Duck
    Businesses and governments worldwide increasingly rely on open source software to reduce development costs, get to market faster, and innovate. Despite its ubiquity, there are many management and security challenges that have accompanied the explosive growth in open source usage. Most organizations don’t know how much open source is in their applications or where it is in their code base. There is considerable confusion and misinformation about the what strategies and tools are needed to identify known open source vulnerabilities in the application code and assure the secure use of open source.

    Please join Black Duck's VP of Security Strategy Mike Pittenger as he unpacks the common myths and misperceptions surrounding open source use and learn best practices to secure and manage your open source, reduce risk from security vulnerabilities and increase efficiency within your SDLC.
  • Black Duck Container Security MasterClass - Security Response Process Recorded: Oct 27 2016 88 mins
    Tim Mackey, Sr. Technology Evangelist; John Beaudoin, Sr. Instructional Design
    Container usage in production environments is becoming commonplace, increasing the need to design for security and develop security response processes. Doing so starts with a clear understanding of what software is running in the datacenter.

    This Container Security Master Class looks at how datacenter operations trends are combining to promote secure container deployments. Although these trends have the potential to abate risk, without a clear understanding of the applications and their dependencies, if a successful attack does occur, the scope of compromise can inadvertently increase.
  • 2016 Open Source Risk Report – Key Findings for M&A Professionals Recorded: Oct 26 2016 59 mins
    Phil Odence, Vice President & General Manager On-Demand Audits; Mike Pittenger, VP Security Strategy
    Open source has been adopted by organizations across all industries, including software, systems, and cloud services. How much open source is used, along with the license, security, and operational risks posed by unmanaged use of open source, is a question M&A professionals need to consider in every transaction.
    This webinar will provide insight from real world data abstracted from Black Duck M&A audits. The data covers hundreds of systems and commercial applications, the code assets of recent acquisition targets, and will illuminate why acquirers should understand exactly what is in the code base before closing the deal. Data will include:
    - The composition of open source v. proprietary code in the average code base
    - The gap between the number of open source components used vs. what was known by the target
    - The prevalence of components using licenses that could put IP at risk
    - Number and age of security vulnerabilities in the open source components
    - An understanding of which components have underactive support communities
Webcasts around application security and open source.
Organizations worldwide use Black Duck products to secure and manage open source software, eliminating pain related to open source security vulnerabilities and open source license compliance.You’ll learn:

• New security challenges facing today’s popular DevOps and Continuous Integration (CI) practices.
• Best practices for designing and incorporating an automated approach to application security into your existing development environment.
• Future development and application security challenges organizations will face and what they can do to prepare.

Embed in website or blog

Successfully added emails: 0
Remove all
  • Title: Managing Open Source in Application Security and Software Development Lifecycle
  • Live at: Sep 15 2016 3:00 pm
  • Presented by: John Steven, CTO, Cigital; Mike Pittenger, VP Security Strategy, Black Duck
  • From:
Your email has been sent.
or close