Today, open source drives technology and development, and its worldwide adoption ranges from companies with a single employee to large corporations like Microsoft and Apple. All of these organizations rely on open source to innovate, reduce development costs, and speed time to market. Recent research reports point out that open source comprises 80% to 90% of the code in a typical application. Our Open Source 360° survey provides an update on the rapid evolution of open source development, use and management.
The 2017 Open Source 360° survey was conducted through Black Duck’s Center for Open Source Research & Innovation (COSRI), focusing on four important areas of open source – usage, risk, contributions and governance/policies. Our respondents include input from new players, established leaders, and influencers across vertical markets and communities. This range of respondents drives broad industry awareness and discussions of these key issues.
Please join Technology Evangelist Tim Mackey (@timintech) and CMO Bob Canaway (@bobcanaway) to review the results from the Open Source 360 Survey. Please bring your questions!
Follow the conversation on Twitter, using the hashtag #OSS360.
RecordedJun 22 201760 mins
Your place is confirmed, we'll send you email reminders
Dave Meurer, Alliances Technical Mgr, Black Duck by Synopsys
It's time to add “Sec” into DevOps! But while moving towards newer processes and technologies like agile methodologies, cloud and containers can help you build faster and deliver continuously, there's always the fear that adding security can severely slow things down. By using GitHub with Black Duck by Synopsys, you can automate your secure development workflows, shift security left, and avoid software rot.
Whether you are an open source developer or enterprise software engineer, GitHub and Synopsys have solutions to help you put “Sec” into the center of DevOps without sacrificing speed and agility. In this live webinar, the experts from Synopsys and GitHub will demonstrate solutions for both open source and enterprise developers. Some highlights will include:
- The real life of a vulnerability in 2017: Apache Struts
- Black Duck CoPilot: It’s Free!
- Black Duck your Pull Requests
Lisa Bryngelson, Sr. Product Manager, Black Duck by Synopsys
Organizations of all kinds increasingly rely on third-party software from their supply chain partners and outsourcers to power the products and technology they deliver to the marketplace. Whether you’re an automotive company or a medical device manufacturer, use of third-party software libraries is now commonplace and essential to success in the competitive global marketplace.
One of the biggest challenges companies face with third-party software is they often have no visibility into the open source libraries being used in the software they embed in their products. Over the last year, a continuous stream of news stories has attributed major security breaches to exploits of vulnerabilities in open source frameworks used by Fortune 100 companies in education, government, financial services, retail and media.
These incidents shine a light on the need for organizations to carefully manage the open source used in the third-party libraries they consumer in order to protect themselves—and their customers—from the consequences of catastrophic security breaches.
Our webinar will arm you with the information and statistics needed to:
-Explain the importance of open source security to your organization
-Understand the key differences between identifying open source in source code vs. binaries
-Define a clear road map for unearthing, managing, and securing the open source hiding in your software supply chain
-Take the steps to help your company avoid becoming the next security breach media story
Jeff Michael, Senior Product Manager and Hal Hearst, Principle Product Manager for Black Duck by Synopsys
The latest Hub release – Hub 4.5 – has some exciting new, customer-driven features. Join our senior product management team as they walk you through some of the latest features and answer your questions, including:
-Snippets scanning: Customers with the Compliance module or Professional Edition now have the ability to find OSS code fragments in their proprietary code.
-License compliance review and approval improvements: Customers with the Compliance Module or Professional Edition will be able to globally review and approve licenses and specify policy rules to manage their use.
-Enterprise user roles: Enhanced and extended Hub user roles allow customers more control and flexibility in distributing access and privileges in the Hub.
-Improvements to the performance of the scan client: Stability and scalability improvements to Hub scan services as well as the scan client allows customers to consistently scan larger code bases.
Today’s automobiles are advanced, complex machines relying on dozens of computers and millions of lines of software code. They are also increasingly targets for sophisticated hackers. In fact, the software running on your car could contain multiple flaws that allow an attacker to take over control of the vehicle – either in your driveway or on the freeway. What steps are manufacturers taking to secure all of that code?
Register for our webinar to learn about these topics and more:
- The kinds of security flaws that are possible and how were they're exploited
- How vulnerabilities can be mitigated
- Ways to build security in from the beginning of the software/system development process
- Unique approaches manufacturers are taking to deal with some of these issues and what that means to you
Erin McGill, Partner Solutions Architect, Amazon Web Services; Dave Meurer, Alliances Technical Mgr, Black Duck by Synopsys
Automation and containerization can help you build faster and deliver continuously, but can also make managing security challenging. By integrating Black Duck Hub with the development tools you use in AWS, you can scan images in your container registry, automate build scans in your CI pipeline, and stay notified on any security vulnerabilities or policy violations found in your open source code.
Join experts from Black Duck by Synopsys and Amazon Web Services as we explore how to build applications and containers safely in the cloud without sacrificing agility, visibility, or control. In this hands-on webinar we’ll demonstrate how to:
-Get started with Black Duck Hub and AWS
-Build better solutions through Open Source Intelligence
-Use open source management automation and integration with AWS
Plus, we'll feature a real-world example using Apache Struts, as well as the resources you can put to use today to gain the security you need without sacrificing the agility you want.
Application security is quickly becoming a "must have" for security teams. High profile breaches, including Equifax and a multitude of ransomware attacks, have the attention of senior management of company Boards. Knowing where to start can be difficult.
Not every company has the same needs or organizational maturity to manage a full-blown application security program. This webinar will cover some of the tools and exercises deployed by application security teams to build security into their processes, including:
- Tools and security tips for each phase of the development lifecycle
- Which tools to use for different types of code
- In-house and 3rd party options for starting an application security program
Steven Zimmerman, Product Marketing Manager, Black Duck by Synopsys
Over the last decade, Black Duck by Synopsys has recognized some of the most innovative and influential open source projects launched during the previous year, as recognition to the success and momentum of these projects, and affirmation of their prospects going forward.
In this webinar, we'll explore the origins and evolution of this year's most outstanding Open Source Rookies, who are investing their efforts in everything from Autonomous Driving, through Scalable Blockchain, and VNF Orchestration, to Personal Security and Relationship Management.
Tim Mackey, Sr. Technology Evangelist at Black Duck by Synopsys
Open source software is embraced by developers, enterprises, and governments at every level, and with it comes many strong opinions and few facts. How much open source is really being used in the applications you buy? Does the "many eyes" theory make open source more secure? Does traditional security testing address vulnerabilities in open source?
With organizations becoming more agile but facing increasing regulatory governance, understanding how open source software development works, and how to secure open source, is increasingly important. In this session we’ll cover:
- Code contribution and IP management
- Fork management
- Release process
- Security response processes
- Realities of IP risk and open source
- Pass through security risk and responsibility
- Keeping up with scope of impact changes within a single disclosure
- Automating awareness of security risk from development through integration and delivery to deployment
Hal Hearst, Senior Product Manager and Phil Odence, Sr. Director & GM of Black Duck On-Demand
How has the massive security breach of 2017, caused by an unpatched open source vulnerability, impacted the way your company thinks about diligence for acquisitions? Whether you are on the buy-side and tightening your checklist to ensure ROI on an asset, or a seller looking to secure the best possible price, making sure there are no diligence surprises is key.
Undoubtedly your company has a list of items that it examines during diligence, and maybe open source license compliance is one. But has open source security risk made it onto the list yet? What are the implications of acquiring an Equifax level issue? The continued growth of the use of open source software underscores the importance of software diligence, and the increasing regulations and potential risks associated with data privacy magnify the point. Join Hal Hearst, Senior Product Manager and Phil Odence, Sr. Director & GM of Black Duck On-Demand for this webinar to examine how the Equifax breach impacted the world of open source, and what that means for your M&A diligence checklist.
Amy DeMartine, Forrester Principal Analyst and Patrick Carey, Synopsys
While software grows more complex and the pace of development accelerates, the stakes for building secure software have never been higher. If you’re like most teams embracing a DevOps culture, you’re focused on breaking down silos, streamlining workflows, and cranking out functional software at a nearly continuous clip. Amid all these fundamental changes, how do you ensure your software is secure without clogging up the pipeline?
Listen as guest Forrester Principal Analyst, Amy DeMartine and Black Duck Open Source Security Expert, Patrick Carey come together to discuss how to automate and distribute application security testing across the SDLC. In this webinar, we’ll discuss
- Why it's important to build application security into your development and operations toolchains and processes
- Best practices for integration application security throughout the application lifecycle
- How to use SAST and SCA together to maximize the security of the software your teams deliver
Jay Dobies, Partner Technical Marketing Engineer, Red Hat; Tim Mackey, Sr. Technology Evangelist, Black Duck by Synopsys
DevOps organizations are increasing turning to container environments to meet the demand for faster, more agile software delivery. Container orchestration presents the most effective way to manage the operational challenges as these production environments scale. However, large-scale container deployments present a new array of security challenges, including how to properly manage open source security risk. A 2017 451 research report recently identified security as the single biggest hurdle to container adoption.
The challenges of managing security risk increase in scope and complexity with the size of your deployment and the number of open source software components that are a part of your application code base. In 2017, dozens of new CVEs were reported every day, making it essential to have good visibility into and control over the open source in use in order to understand if any known vulnerabilities are present.
Join experts from Red Hat and Black Duck as they share the latest insights and recommendations for securing open source in your containers. You’ll learn:
- The role of containers in addressing some of the problems faced by teams moving to DevOps
- How OpenShift enhances that solution by answering questions of networking, image registries, deployment automation, application lifecycle, etc.
- Why container environments present new application security challenges, including those posed by open source
- How to scan applications running in containers to identify open source and map against known vulnerabilities
- Best practices and methodologies for deploying secure containers with trust
Jeff Michael, Senior Product Manager and Chris Fearon, Senior Manager, Research Engineering
As development teams automate the software development lifecycle through the use of agile DevOps tools and practices, the need to mitigate open source risk throughout the DevOps tool chain has become critical.
Learn how to extract maximum value from your investment in Black Duck Hub through this in-depth webinar focused on:
- Vulnerability Triage—Ranking vulnerabilities in open source components by the risk of a successful attack and the potential impact on your business.
- Prioritization—Using Hub policy management to categorize development projects by security priority and to flag high-risk open source components.
- Remediation—Tracking the remediation status of all open source vulnerabilities in any given development project.
Lisa Bryngelson, Sr. Product Manager, Black Duck; Niles Madison, Manager, Code Quality Audits - Black Duck On-Demand
Data related web services are becoming important for enterprises for achieving their businesses goals. Web services create tremendous business value for them, but the improper use of web services could pose legal and security risks. At Black Duck, we have devised a technology that detects the usage of APIs in the source codes. Our technology automatically detects the legal agreements applicable to the usage of web services and quantify the legal and security risk associated with them. In this webinar, we will share the insights we gained by analyzing 300 real SaaS projects. In particular, we will discuss the relationship between legal documents, privacy, compliance and security risks that come with the usage of web services.
Utsav Sanghani, Senior Product Manager - Product Integrations and Web Services, Black Duck Software by Synopsys
Agile development and DevOps are built on a foundation integrated and automated testing that happens throughout the development lifecycle. Rather than waiting for a testing phase that happens late in the cycle, software quality and security must be verified at every step. In this session you will learn how to validate open source security, compliance, and quality across the SDLC, from design phase to production deployment and beyond.
Craig Froelich is the chief information security officer (CISO) for Bank of America. He leads the Global Information Security team responsible for security strategy, policy, and programs. Before moving to Bank of America through acquisition, he was responsible for Countrywide’s cyber security technology, networks, crisis management, and security operations. Craig has over a decade of experience in product management and application development for software and hardware companies. He also serves on the board of FS-ISAC and the executive committee of BITS. On Twitter, he describes himself as “a SoCal dude learning to be a southern gentleman” as a Los Angeles transplant to Charlotte, North Carolina, where he lives with his family.
Listen as Gary and Craig discuss the role of the CISO in the financial services ecosystem and the newly released 2018 CISO Report.
Mark Radcliffe, Partner, DLA Piper/Counsel OSI; Phil Odence, Sr. Director / GM at Black Duck Software by Synopsys
Gain insights into these important legal developments from two of the leading open source legal experts, Mark Radcliffe, Partner at DLA Piper and General Counsel for the Open Source Initiative and Phil Odence, Sr. Director and General Manager at Black Duck Software by Synopsys. This annual review will highlight the most significant legal developments related to open source software in 2017, including:
- Current litigation
- An open source security update
- Blockchain and its forks
- Software Package Data Exchange (SPDX) and OpenChain
- And more
Live attendees will be receiving a CLE credit for this webinar.
Bruce Potter is CISO at Expel, where he is responsible for cyber risk and ensuring the secure operation of Expel’s services. Previously, Bruce co-founded Ponte Technologies (sold to KeyW Corporation). He then served as CTO at KeyW for 2 years. Before that, Bruce was a security consultant at Cigital. In a seemingly previous life, Bruce founded the Shmoo Group. To this day, he helps run the annual hacker conference ShmooCon. He has co-authored several books, including “802.11 Security,” “Aggressive Network Self-Defense,” and “Host Integrity Monitoring.” Bruce regularly speaks at DEF CON, Black Hat, and O’Reilly Security conferences. He lives in Maryland with his family.
Listen as Gary and Bruce discuss ShmooCon, the state of software security books, network security trends, hacking back, the relationship between preventative security engineering and operational security, DevOps, the CISO role, and more.
Mike Pittenger, VP Security Strategy, Black Duck Software
Vulnerabilities are an inevitable part of software development and management. Whether it’s open source or custom code, new vulnerabilities will be discovered as a code base ages. A 2017 Black Duck analysis of code audits conducted on 1,071 applications found that 97% contained open source, but 67% of the applications had open source vulnerabilities, half of which were categorized as severe. As the number of disclosures, patches, and updates grows, security professionals must decide which items are critical and must be addressed immediately and which items can be deferred.
Join Black Duck’s VP of Security Strategy, Mike Pittenger, for a 30-minute discussion of best practices in open source security and vulnerability management. You’ll learn:
- Methods for determining which applications are most attractive to attackers, and which pose the greatest risk
- Ways to assess the risk associated with a disclosed open source vulnerability
- Strategies to minimize the impact of open source security vulnerabilities when immediate fixes can’t be made
IT operations teams are now deploying and running hundreds or even thousands of containers at any given time. This rapid deployment surfaces challenges in validating the contents and security of container images being deployed. In this session, Black Duck container and virtualization expert Tim Mackey will provide an overview of technologies and solutions such as Red Hat OpenShift that enable organizations to deploy containers at scale securely.
In this webinar, Tim Mackey explores this new era of large scale container deployments and how to manage and secure them.
Attend and you'll learn:
- How to maintain visibility and control for the open source deployed in hundreds of containers
- How to help your development and operations teams work together to maintain the security of containers in production
- How to build security into your deployment of container orchestration platforms
- Measures you can take to proactively identify risks and remediate risks on containers in production
- How you can use Black Duck OpsSight to scan containers being created, updated or deployed through their container orchestration platforms
Stephen Elliott, Product Manager Google Container Registry and Dave Meurer, Director Technical Alliances
DevOps teams are using cloud platforms and containers to build, deploy, and manage applications faster than ever, and utilizing large amounts of open-source software to increase agility. Google Cloud platform makes building and shipping containers even easier with Google Container Builder, Google Container Engine (GKE), and Google Container Registry (GCR). But when you deploy a container or cloud-native application, it’s hard to know exactly what contents are inside, and that can make managing security painful.
Secure DevOps means having full visibility and control of your software supply chain to implement security and governance policies. How do you protect your DevOps without slowing down? Join experts from Google and Black Duck to discuss how to secure the software supply chain including:
- Understanding the modern attack landscape
- How to select safe and healthy open source software in development
- How you can automate open source control and visibility in containers with Black Duck and both Google Container Builder and GCR
- The Grafeas and Kritis projects, and the work Google and Black Duck are doing to enhance security visibility and provide policy enforcement for containers.
Webcasts around application security and container security.
Black Duck by Synopsys provides automated solutions for securing and managing open source software. With the rapid, widespread adoption of open source software, Black Duck is a key component of Synopsys’ Software Integrity Platform, the most comprehensive solution for integrating security into the SDLC and software supply chain.