Hi [[ session.user.profile.firstName ]]

The State of Open Source Security Vulnerabilities in 2020

WhiteSource’s Annual Report on The State of Open Source Security Vulnerabilities in 2020 found that a record-breaking number of new open source security vulnerabilities in was published in 2019.

In our research, we focused on open source security’s weakest and strongest points in the hopes of bringing some clarity to the fast-paced and complex space of known open source security vulnerabilities.

Join Jeffrey Martin, Senior Director of Product and Sharon Sharlin, Product Marketing Manager at WhiteSource as they discuss:
•How the open source community is evolving when it comes to security research and what to expect in 2020.
•Ways software development outfits can implement secure coding from the earliest stages of the DevOps pipeline.
•Best practices for development, DevOps, and Security teams to make sure they address the most critical issues to their software products’ security.
Recorded May 26 2020 56 mins
Your place is confirmed,
we'll send you email reminders
Presented by
Jeffrey Martin, Senior Director of Product and Sharon Sharlin, Product Marketing Manager
Presentation preview: The State of Open Source Security Vulnerabilities in 2020

Network with like-minded attendees

  • [[ session.user.profile.displayName ]]
    Add a photo
    • [[ session.user.profile.displayName ]]
    • [[ session.user.profile.jobTitle ]]
    • [[ session.user.profile.companyName ]]
    • [[ userProfileTemplateHelper.getLocation(session.user.profile) ]]
  • [[ card.displayName ]]
    • [[ card.displayName ]]
    • [[ card.jobTitle ]]
    • [[ card.companyName ]]
    • [[ userProfileTemplateHelper.getLocation(card) ]]
  • Channel
  • Channel profile
  • The Security Phoenix: A Modern Approach to DevSecOps Focus on People Jul 28 2020 5:00 pm UTC 58 mins
    Francesco Cipollone, Head of Cloud Security Alliance, Director of NSC42
    DevSecOps is usually a tool or fast speed approach to the organization. This talk, however, will take you through a different approach.

    With a holistic view of the organization, the security phoenix methodology takes into account a large organization with assessment, maturity matrix, scoring system and measurement options. We will walk through the problem of Build and Test (DEV/TEST) and how they relate to Design and Operate in a modern approach to SDLC.

    Why is the metric important and how to measure progress? The talk is aimed at specialists that want a holistic approach of DevSecOps, a practitioner that wonders where an architect or ops guy fits in this brave new world.

    The talk will give a real-life example, stories, as well as use cases to take the fluff talk out of the DevSecOps phrase! We talk real numbers and cases here, so tune in.
  • What Going All-Remote Taught Us About AppSec and Testing Shortfalls Jul 23 2020 5:00 pm UTC 49 mins
    Rhys Arkins, Director of Product Management at WhiteSource and Gleb Bahmutov, VP of Engineering at Cypress
    The Covid-19 pandemic led to a lot of tech companies converting to remote teams almost overnight, and for some this may even become the norm.

    While conferencing such as Zoom are widely known for substituting for face-to-face meetings, it's much less appreciated how the disruption has increased asynchronous communication approaches as people are not always available online at the same time.

    Shifting to asynchronous communication has shown up some weaknesses companies may have had, particularly when it came to security and testing.

    If a company's approach to these had been more manual and revolved around the relevant people being co-located or in constant direct communication, then this lack of process or automation can result in increased risk.

    So as we adjust to new ways of working, how do you ensure that your appsec procedures are designed to withstand any changes in your team dynamics ?

    Join this session and leave with insights on:
    -What did going involuntarily remote reveal to us about existing security and testing weaknesses?
    -Practical examples of ad-hoc or manual security vs automation
    -What should change forever even if/once we go back to "normal"?
  • Leading the Transformation Jul 21 2020 5:00 pm UTC 60 mins
    Panel Discussion feat. Rhys Arkins, Director of Product Management
    Digital transformation has been occurring in organizations of all sizes for the past few years, yet the process isn’t moving fast enough to move the needle in many companies.

    How can DevOps help increase the velocity and impact of digital transformation?

    This panel webinar discusses the relationship between DevOps and digital transformation and ways organizations can increase their chances of a successful digital transformation through DevOps, including agility, velocity and security.
  • AppSec: Pushing Left, Like A Boss Jul 14 2020 5:00 pm UTC 58 mins
    Tanya Janca, Security Trainer and Coach SheHacksPurple.dev
    With incident response and penetration testing currently receiving most of our application security dollars, it would appear that industry has decided to treat the symptom instead of the disease.

    “Pushing left” refers to starting security earlier in the SDLC; addressing the problem throughout the process.

    From scanning your code with a vulnerability scanner to red team exercises, developer education programs and bug bounties, this talk will show you how to ‘push left', like a boss.
  • From Zero to DevSecOps: How to Implement Security at the Speed of DevOps Recorded: Jun 25 2020 59 mins
    Jeffrey Martin, Senior Director of Product at WhiteSource and Anders Wallgren, VP of Technology Strategy at CloudBees
    Your organization has already embraced the DevOps methodology? That’s a great start. But what about security?
    It’s a fact - many organizations fear that adding security to their DevOps practices will severely slow down their development processes. But this doesn’t need to be the case.
    Tune in to hear Jeff Martin, Senior Director of Product at WhiteSource and Anders Wallgren, VP of Technology Strategy at Cloudbees, as they discuss:
    - Why traditional DevOps has shifted, and what this will mean
    - Who should own security in the age of DevOps
    - Which tools and strategies are needed to implement continuous security throughout the DevOps pipeline
  • State of the Market: CI/CD/ARA Recorded: Jun 16 2020 60 mins
    Panel Discussion feat. Rhys Arkins, Director of Product Management
    The continuous integration/continuous delivery market has gone through many changes since DevOps came on the scene, but it remains the backbone of the DevOps toolchain.

    Application release automation has also joined the ranks of must-have DevOps technologies.

    So where does the market stand currently and what can we expect to see in the next generation of CI/CD/ARA tools?

    This webinar delves into the latest in the CI/CD/ARA space and offers a glimpse at what’s to come.
  • Harnessing development to scale AppSec Recorded: Jun 4 2020 37 mins
    Jeffrey Martin, Senior Director of Product at WhiteSource and Fernando Diaz, Technical Marketing Manager at GitLab
    GitLab helps you to scale security across your Continuous Integration (CI) process enabling developers to test their code with every code change, right in their existing workflow.

    By seamlessly integrating WhiteSource’s security application testing solution in GitLab CI, we further reduce context switching and increase developer productivity. This enables developers and InfoSec professionals to work together to enhance application security in one integrated platform and continue shifting left.

    Join us in learning how to leverage the GitLab developer’s workflow and the value of integrating WhiteSource’s security testing solution directly into that workflow.

    We will share some best practices around shifting security left and demonstrate how to integrate WhiteSource into GitLab’s merge request pipeline and security dashboard.
  • The State of Open Source Security Vulnerabilities in 2020 Recorded: May 26 2020 56 mins
    Jeffrey Martin, Senior Director of Product and Sharon Sharlin, Product Marketing Manager
    WhiteSource’s Annual Report on The State of Open Source Security Vulnerabilities in 2020 found that a record-breaking number of new open source security vulnerabilities in was published in 2019.

    In our research, we focused on open source security’s weakest and strongest points in the hopes of bringing some clarity to the fast-paced and complex space of known open source security vulnerabilities.

    Join Jeffrey Martin, Senior Director of Product and Sharon Sharlin, Product Marketing Manager at WhiteSource as they discuss:
    •How the open source community is evolving when it comes to security research and what to expect in 2020.
    •Ways software development outfits can implement secure coding from the earliest stages of the DevOps pipeline.
    •Best practices for development, DevOps, and Security teams to make sure they address the most critical issues to their software products’ security.
  • Innocent Vulnerabilities vs Malicious Backdoors: How to Manage Your Risk Recorded: May 21 2020 56 mins
    Rhys Arkins, Director of Product Management
    Have you considered what truly separates accidental vulnerabilities in open source from intentionally malicious releases? Although often grouped together as "vulnerabilities", malicious open source components are very different, right from their very creation through to the way you mitigate and remediate them as an end user. The past 12 months saw a record-breaking time for detection of malicious components in the world's most popular package registries.

    Join Rhys Arkins, Director of Product, as he will discuss:

    1. The key differences between accidental vulnerabilities and malicious releases

    2. How to manage the risk for each type of vulnerability

    3. Lessons learned from the most interesting malicious packages spotted during 2019
  • The State of Open Source Security Recorded: May 12 2020 57 mins
    Jeffrey Martin, Senior Director of Product
    Open source security, once viewed as an oxymoron, has come into its own as a way for organizations to secure their environments without breaking their bank. As a result, a plethora of open source security technologies have flooded the market, creating more opportunity as well as challenges and a healthy dose of confusion. The webinar looks at the state of the open source security market and trends in open source security, and examines some of the potential benefits and pitfalls.
  • 5 Things to know about Open Source Security Recorded: May 5 2020 35 mins
    Sharon Sharlin, Product Marketing Manager
    Open Source has become the key building block for application development in today's market, where companies are under constant pressure to accelerate time to market.
    The increasing adoption of open source components, however, has introduced new security challenges that most teams are not prepared to mitigate in their current posture.
    Join the industry expert, at Whitesource, as she presents the 5 approaches and best practices that security teams should implement in order to enable their developers to harness the power of open source without slowing them down or compromising on security.
  • Assessing the Kubernetes Landscape Recorded: Apr 16 2020 63 mins
    Panel discussion featuring Shiri Ivtsan, Senior Product Manager
    In the runup to KubeCon + CloudNativeCon Europe, we’ll examine what’s happening in the Kubernetes and containers landscape, including new technologies, services and ecosystems worth knowing about as well as changes looming on the horizon
  • Open Source Security: How to Lay the Groundwork for a Secure Culture Recorded: Apr 14 2020 45 mins
    Guy Bar Gil, Product Manager
    Open-source components are prevalent in approximately 97% of modern applications and dominate anywhere between 60-80% of their codebases.

    This is hardly surprising given how integrating open source accelerates software development and enables organizations to keep up with today's frantic release pace and standards of constantly supplying new features and improvements.
  • Fire alarms vs. Fire hoses: Keeping up with Dependencies Recorded: Mar 24 2020 56 mins
    Rhys Arkins, Director of Product Management
    Today no one can claim ignorance about the need for an open source vulnerability strategy, so what is yours? Are you the fire alarm type, who prefers to sit tight unless a vulnerability alert is ringing in your inbox? Or are you the fire hose type, staying ahead of the game with a never-ending stream of open source updates to apply? Join Rhys as he discusses the pros and cons of these two approaches, as well as whether there's a magical middle ground between the two which doesn't involve a fire analogy.
  • Whose Vulnerability Is It Anyway? Recorded: Mar 17 2020 52 mins
    Jeffrey Martin and Rhys Arkins
    Application security is a top priority today for companies that are developing software.
    However, it is also becoming more challenging and complex as release frequency continues to rise, more open source components are adopted, and the requirements for data security are getting stricter.

    Thanks to new DevOps practices and tools, development cycles are getting shorter, allowing organizations to meet market demands and deliver a superior customer experience, but is application security keeping up? How is it possible to develop at the speed of business, while also maintaining application security, particularly for open source components? Developers have a key role to play in balancing security with the need for rapid innovation.

    Join Jeffrey Martin and Rhys Arkins, the Directors of Product at WhiteSource, as they discuss:

    -The latest insights leading AppSec and open source security to shift left into early stages;

    -Conclusions from our research that encompassed a survey of over 650 software developers worldwide;

    -Strategies and tools that can be used to develop both quickly and securely.
  • Panel: Developers Do Security Recorded: Feb 27 2020 35 mins
    Shiri Ivtsan, Senior Product Manager
    Amid all the talk of shifting left, mingling the DevOps and Security tribes and how can we do code better, faster and with more quality a funny thing happened. Security vendors are developing security tools for devs and DevOps. The security team still pays for them, but they won't buy them without Dev and DevOps buy in. What does this mean for 2020? Will we see better "quality (codeword for security)" in our apps? What should security teams be doing to make this happen? What should Devs and DevOps teams do to adopt these new developer-friendly tools? Is 2020 the year DevSecOps makes a difference?
  • Barriers to Container Security and How to Overcome Them Recorded: Feb 25 2020 54 mins
    Jeffrey Martin, Senior Director of Product at WhiteSource
    Over the past few years, more and more companies are turning to containerized environments to scale their applications.
    However, keeping containers secure throughout the development life cycle presents many challenges to security and development teams. In order to address them, organizations need to adopt a new set of security processes and tools.
    This session will focus on the three most vulnerable areas of container security and the best practices to help teams develop and deploy securely.
    Join Jeffrey Martin, Senior Director of Product at WhiteSource, as he discusses:
    The top challenges to security in containerized environments
    How DevSecOps addresses security in containerized environments
    Tips and tricks for successfully incorporating security into the container lifecycle
  • DevSecOps: Closing the Loop from Detection to Remediation Recorded: Feb 17 2020 59 mins
    Shiri Ivtsan, Senior Product Manager
    DevSecOps sets out to relieve the costly and stressful delays that can occur when security testing is performed late in the game, by setting up processes and tools for "shifting left" so security testing can happen early and often. As organizations continue to embrace this DevSecOps approach, testing tools and practices are integrated even further left in the development pipeline.

    Join Senior Product Manager, Shiri Ivtsan, as she discusses:

    Where and how developers are implementing DevSecOps in the SDLC;
    Best practices for developers to adopt DevSecOps and more efficiently handle vulnerabilities;
    Necessary steps for implementing a process for detection, prioritization, and remediation of open source vulnerabilities.
  • Panel Discussion: Scaling DevSecOps Recorded: Jan 27 2020 56 mins
    Jeffrey Martin, Director of Product at WhiteSource
    The need to include security as part of the DevOps process is well-understood, and greater numbers of DevOps teams are shifting security left to ensure their applications are more secure. But how can an organization scale its DevSecOps efforts without introducing unnecessary friction in the software development life cycle? This webinar explores some of the pitfalls to avoid when looking to scale DevSecOps and offers tips to help organizations keep their DevSecOps efforts on track.
  • Tackling the Container Iceberg: How to Approach Open Source Security Recorded: Jan 21 2020 60 mins
    Jeffrey Martin (Director of Product) and Dan Garfield (Chief Technology Evangelist at Codefresh)
    Container images are based on many direct and indirect open source dependencies, which most developers are not aware of. What are the security implications of only seeing the tip of the iceberg? What are the challenges one faces when relying so heavily on open source? And how can teams overcome these?

    Join Codefresh and WhiteSource, as they embark on a journey to tackle:

    *The container iceberg - learn what are your blind spots
    *The main security challenges when using open source in containerized applications
    *The role of automation in open source security in containers
    *A live demo showing how WhiteSource & Codefresh can allow you to automate open source security in containers throughout the DevOps pipeline
An open source security and licenses management solution
WhiteSource allows engineering, security and compliance officers to effortlessly secure and manage the use of open source components in their software, allowing developers to focus on building great products. WhiteSource fully automates all open source management processes: component detection; security vulnerability alerts and fixes; license risk and compliance analysis along with policy enforcement; quality review, and new version alerts. It offers a complete suite of control, reporting and management to help software teams manage open source truly effortlessly. For more information about WhiteSource, visit http://www.whitesourcesoftware.com or follow us on twitter: @whitesourcesoft

Embed in website or blog

Successfully added emails: 0
Remove all
  • Title: The State of Open Source Security Vulnerabilities in 2020
  • Live at: May 26 2020 2:00 pm
  • Presented by: Jeffrey Martin, Senior Director of Product and Sharon Sharlin, Product Marketing Manager
  • From:
Your email has been sent.
or close