Name: M&A and Open Source During Uncertain Times
Start: 2020-09-24T17:00:00Z
End: 2020-09-24T17:55:32.000Z
Location: BrightTALK
Rating: 5

Up to 90% of any piece of software is from open source, creating countless dependencies and areas of risk to manage. FOSSA is the most reliable automated policy engine for vulnerability management, license compliance, and code quality across the open source stack. With FOSSA, engineering, security, and legal teams all get complete and continuous risk mitigation for the entire software supply chain, integrated into each of their existing workflows.

Given the large volume of open source software in modern applications, it can be quite difficult to manage OSS license compliance obligations with manual processes alone. But picking the right compliance tool — and then realizing value from it on an ongoing basis — can be easier said than done, especially given the feature-rich nature of modern solutions .  

IP attorney Heather Meeker, one of the world’s foremost experts in open source license compliance, will offer guidance in these critical areas (evaluating new tools and maximizing existing ones) in our upcoming webinar. Heather will discuss topics like:

-Differences between types of license compliance tools
-Features and capabilities to prioritize depending on your business objectives
-Strategies to integrate tools into engineering workflows
-How the current generation of tools can support attribution notice and due diligence requirements

The Lawyer’s Guide to OSS License Compliance Tools, Featuring Heather Meeker

Open source license scanning tools like FOSSA play an important role in software development for many organizations. That’s because these tools automate what would otherwise be the manual (and time-consuming) process of identifying and inventorying the licenses that govern use of open source code

But how, exactly, does a license scanner work? And how can you be sure they produce accurate results? 

Join FOSSA software engineer Scott Patten on June 29 for answers to these questions and more. Scott will share a behind-the-scenes look at our new license scanning technology, including insight into topics like:

-Design priorities for our new license scanner 
-Types of license matching
-A deep dive into the license detection algorithms
-Important lessons learned

Under the Hood of FOSSA’s New License Scanner

Identifying and mitigating known vulnerabilities in open source code has long been a foundational part of secure software development. But over the past year, we’ve seen an increase in novel software supply chain attacks happening before CVEs are published.

As a consequence, focusing on remediating CVEs — without accounting for other indicators of vulnerable open source — can put applications at risk. 

Join FOSSA security experts on Wednesday, May 25 to explore these emerging signs of risky or compromised open source packages — and to get actionable guidance on addressing them. We’ll discuss challenges and solutions in areas like:

-Empty packages
-Abandonware
-Remote dependencies
-Typosquatting

Beyond the CVE: Addressing Novel Supply Chain Risks

In the hours, days, and weeks following the disclosure of the Log4J zero-day vulnerability, FOSSA’s security engineering team implemented a comprehensive plan to help our customers respond.

Senior software security engineer Matt Schwartz helped lead these efforts, working hand in hand with customers to minimize the vulnerability’s impact.


Join Matt on April 13 for an inside look at FOSSA and our customers’ response to Log4Shell — and how the lessons we learned can help your organization prepare for the next zero-day vulnerability. He’ll discuss:

-How Log4Shell impacted FOSSA customers  
-Strategies to mitigate vulnerabilities in direct and transitive dependencies
-The biggest lessons we learned  
-Steps you can take now to prepare for the next zero-day vulnerability

Log4Shell: A Case Study in Responding to OSS 0-Day Attacks

If you're an in-house lawyer, today's deal market means any day may bring news of an IPO, merger, or even fast-tracked SPAC acquisition. 

The ubiquitous nature of open source software in modern applications means it’s likely that license compliance will be part of due diligence. And, any compliance issues that surface during this assessment may present significant roadblocks to a successful transaction. 

Are you prepared to brief your CEO on the status of open source license compliance if asked right now? Could flaws in your company’s code emerge after an IPO, bringing about major business and reputational harm for all involved?  

In today’s market, even tech-savvy legal departments would be wise to revisit the IP risks presented by open source software, with an eye toward implementing continuous license compliance and ditching the one-off audits. 

In this webinar with our friends at Above the Law, we discuss:

-How to prepare for transaction-related compliance reviews in an era of ever-increasing complexity and ever-decreasing timelines
-How OSS license compliance impacts the SPAC boom and other transaction trends 
-How to implement a system of continuous compliance and the benefits of doing so
-How to anticipate and address any cybersecurity issues raised by open source code

How to Ensure OSS License Compliance Doesn't Tank a Transaction

Rancher Labs has long been considered a pioneer in container orchestration. The marketing-leading Kubernetes management platform (acquired by SUSE in late 2020) is entirely open source, meaning users retain maximum flexibility with no vendor lock-in. 

Since it was founded nearly a decade ago, Rancher has worked hard to stay at the forefront of cloud native innovation. In mid-2021, the company took another big step on that journey when it implemented FOSSA Software Composition Analysis.

Join Rancher Labs’ Senior Engineering Manager Hayden Barnes (formerly of Canonical and founder of Pengwin Linux) for a conversation about how Rancher has used FOSSA to manage OSS license compliance, reduce security risks, and increase development velocity — and how your organization can reap similar benefits.

We’ll discuss:

-Why Rancher Labs selected FOSSA, and lessons learned from implementation
-How and why Rancher Labs integrated FOSSA into its CI/CD 
-Strategies for making risk management a standard part of software development
-Best practices for generating and maintaining up-to-date compliance reports

For any questions or follow-ups, contact the webinar presenters:

Hayden Barnes: https://twitter.com/unixterminal | hayden.barnes@suse.com
FOSSA: demand@fossa.com

How Rancher Labs Increased Development Efficiency and Security with FOSSA

Software supply chain security has dominated the headlines in recent months following a series of events (including the SolarWinds hack and the Biden Administration’s executive order). But maintaining the integrity of your software supply chain is about more than just traditional vulnerability remediation.

Our modern threat landscape has elevated the importance of supply chain sustainability, which includes areas like software provenance and lifecycle management in addition to known vulnerability mitigation.

Join Shane Coughlan, GM of OpenChain (a Linux Foundation project) for a conversation on the importance of supply chain sustainability and practical steps your organization can take to strengthen supply chain integrity. We’ll discuss:

-The evolution of software supply chain threats
-The importance of software provenance, such as package origin, maintainers, and quality
-Questions to ask vendors to gauge the sustainability of proprietary software
-Indicators of sustainable open source software

The Path to a Sustainable Software Supply Chain

C and C++ are amongst the most popular languages in the world. Designed for programming embedded, resource-constrained software and large systems, they are widely used because of their efficiency, stability and portability. 

But unlike other languages, C/C++ do not have standardized package management, which creates complexity in scanning and managing dependencies.

During this webinar, Kit Martin, one of FOSSA's Software Engineers, will explore the complexities of scanning C/C++ code for dependencies. Topics will include:

- How scanning for C/C++ differs from other managed languages
- Various packaging scenarios in C/C++ 
- Challenges with C/C++ with vulnerabilities

Challenges in Scanning C/C++ Code for Dependencies

Get ready for a FOSSA 101. Register for this session and get a quick primer on how to get started with FOSSA. Our FOSSA Product Engineer will walk you through the platform and demonstrate how to: 
 
- Use the FOSSA CLI to scan your code
- Identify dependencies, license compliance issues and vulnerabilities
- Configure license and security policies 
- Integrate with your existing tools

Live Webinar: Getting Started with FOSSA

The recent disclosure of a severe vulnerability impacting Log4J — an extremely popular Java open source logging library — has sparked a five-alarm fire in the security world and beyond. 

Not only is Log4J used in countless applications across the world, but programs that use a vulnerable version of the library are subject to remote code execution.

FOSSA will share insights into the Log4J vulnerability, including a live demo of the vulnerability being exploited and a look at how you can use our free CLI to identify if you’re using potentially vulnerable dependencies. We’ll also discuss:

-Log4J background: how the vulnerability came into existence and the mechanics behind it
-The wide-ranging impact of the vulnerability 
-Remediation strategies: version upgrades and beyond

An Interactive Exploration of the Log4J Vulnerability

The AGPL — a strong network copyleft open source software license — has been in the news because of alleged license violations committed by Truth Social (a planned Trump Media and Technology Group social media website).

But while the Truth Social controversy has placed a spotlight on the AGPL, the license has long held a unique place in the world of open source software because of its provisions that cover the SaaS deployment model. 

Join IP attorney Heather Meeker, one of the world’s foremost experts in open source license compliance, for insight on the AGPL, its key provisions, and the Truth Social situation. You’ll learn:

-Approaches to the use of the AGPL in dual-licensing models
-How the AGPL compares to the GPL v2 and GPL v3
-Practical strategies for complying with the the AGPL
-Important takeaways from the Truth Social situation

Truth Social, AGPL, and OSS License Compliance

Learn how the best software companies in the world are using Enterprise architecture to scale their Open Source usage & Open Source compliance. Join us as we discuss the importance of Open Source Management within Enterprise technology initiatives, and focus on how to best apply this management within the software development life cycle — no matter what methodologies you may be using. 

This webinar will cover:
* Emerging trends in Open Source Usage in the Enterprise
* Three major software architecture areas affecting compliance governance
* Best practices for managing compliance governance in the Enterprise

Presenter Carlos Cheung is the Head of Open Source at FOSSA, and also serves on the Business Advisory Council at Georgetown University's McDonough School of Business. He has held product management and software engineering roles at Optimizely, VoiceLabs and other San Francisco Bay Area SaaS companies.

Enterprise Software Architecture and Open Source Compliance

From manufacturing to financial services and everything in between, organizations across industries have embraced open source software (OSS). But as OSS has increased in popularity, so too have challenges relating to security, quality, and license compliance.

In this panel webinar, global IT solutions provider Wipro and financial services platform Moonfare will discuss their experiences with OSS, including trends, best practices for compliance and security, and pitfalls to avoid.

Best Practice in Open Source Compliance and Security with Wipro & Moonfare

Recent cyberattacks and the Biden Administration's Cybersecurity Executive Order have put the spotlight on Software Bill of Materials (SBOMs). The executive order requires organizations that sell into the federal government to produce an SBOM with each product (or as part of a public website), while analysts expect a detailed and regularly updated SBOM to be a non-negotiable requirement for most enterprise software buyers by 2024. In light of the recent NTIA regulations, you won’t want to miss this informative webinar. 

Join us on September 16, 2021, as FOSSA’s Director of Sales Engineering, Deepak Mehta,  discusses how FOSSA enables customers to generate precise and fast SBOMs that will meet their mission-critical use cases. In addition, he will cover:
- What is an SBOM and why we need them
- Use cases of SBOMs 
- Generating an SBOM 
- Creating an SBOM with FOSSA (live demo)

Live Webinar & Demo: SBOMs Made Simple with FOSSA

The rise in autonomous and connected vehicles means our cars now contain more and more electronics and software. Increasingly, OEMs and their suppliers are turning to Open Source Software (OSS) to boost engineering velocity and drive innovation. Meanwhile, legal teams have to deal with a complex web of licenses and ensure that there are no violations of license terms or problematic usage of copyleft licenses.
 
With that as a backdrop, we’ve convened a panel of industry experts to discuss today’s compliance landscape in the automotive industry. We’ll discuss:

- Best practices in collaborating with stakeholders to assess and resolve license issues
- Overcoming obstacles in policy creation
- How to make the license compliance process faster and more efficient
- Managing security vulnerabilities and regulations like the US Cybersecurity Executive Order

Live Panel: Simplifying OSS Compliance in the Automotive Industry

Open source software has drastically increased code reusability and access while decreasing the cost and time to deliver reliable code. It has become so commonplace and ubiquitous that over 90% of production software is now written and maintained by external parties. 

But these benefits come with some measure of potential risk in the form of an expanded attack surface. Securing your own code and developers’ tools is no longer enough to defend against all threats. This presentation will explore how vulnerabilities are discovered, verified, and the scope of impact they could have if they were exploited by a malicious party. More importantly, we will also cover the steps that can be taken to protect projects and their use of open source software from being vulnerable to dependency confusion attacks.

Attacking Applications via Upstream Dependency Maintainers

We live in unprecedented times but many companies are using the uncertainty as an opportunity to grow by either merging or being acquired. But what was once an already complex process, modifications to the M&A open source process is mandatory. 

Join our panel discussion with legal counsel and M&A experts Alessandra Simmons, (Goodwin Law); Steven Argentieri, Goodwin Law; and Brad Goldring from GTC Law as they discuss:
- M&A due diligence: trends before and during a pandemic
- Due diligence limitations during the pandemic 
- Risk factors in M&A due diligence
- Differentiating between open source consumer versus contributor
- Best practices on navigating through uncertain times

M&A and Open Source During Uncertain Times

We have all heard the buzz about developer-centric application security. But implementing a modern AppSec program can be challenging.
 
Join Scott Gerlach (CSO, StackHawk) and Solomon Rubin (Software Engineer, FOSSA) as they discuss how you can automate and integrate application security testing in CI/CD with GitHub actions. Together, the two will walk through how you can test for vulnerabilities in all of your applications – including open source, proprietary code, and containers.
 
By the end of the session, you will have the right tools to test for security vulnerabilities on every merge.

Automating Application Security Testing with  Github Actions

We live in unprecedented times but many companies are using the uncertainty as an opportunity to grow by either merging or being acquired. But what was once an already a complex process, modifications to the M&A open source process is mandatory. 

Join our panel discussion with legal counsel and M&A experts Steven Argentieri from Goodwin Law and Brad Goldring from GTC Law as they discuss:
- M&A due diligence: trends before and during a pandemic
- Due diligence limitations during the pandemic 
- Risk factors in M&A due diligence
- Differentiating between open source consumer versus contributor
- Best practices on navigating through uncertain times

Open Source

Compliance

Due Diligence

Legal IT

Enterprise Applications

Software Asset Management

Mergers

Mergers and Acquisitions

Intellectual property law is crucial to ensuring that you or your organization have exclusive rights to that assets that you’ve created. The BrightTALK intellectual property community has thousands of professionals focused on learning and exchanging information about intellectual property management, intellectual property software and how to protect intellectual property. Join the community for access to free, interactive presentations or attend live webinars to have your questions answered by IP lawyers and industry experts.

Intellectual Property

The legal community on BrightTALK combines the fields of employment law, e-discovery, intellectual property and environmental law to create a thriving ecosystem of legal resources. Attend live and on-demand webinars dealing with employment contract law, e-discovery solutions, intellectual property software and sustainable development from leading lawyers and legal professionals to gain knowledge in a wide range of fields. Join the community and be part of the conversation by attending live legal webinars and connecting with industry thought leaders.

Legal

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

The application development community features top thought leadership focusing on optimal practices in software development, SDLC methodology, mobile app development and application development platforms and tools. Join top software engineers and coders as they cover emerging trends in everything from enterprise app development to developing for mobile platforms such as Android and iOS.

Application Development

Enterprise applications have become a crucial piece of infrastructure for many businesses. The enterprise applications community on BrightTALK features the latest insights in enterprise application integration, enterprise application architecture and EAS software. Join the community to gain access to thousands of videos and webinars presented by recognized enterprise information systems experts and arm yourself with the knowledge you need to succeed.

Join thousands of engaged IT professionals in the application management community on BrightTALK. Interact with your peers in relevant webinars and videos on the latest trends and best practices for application lifecycle management, application performance management and application development.

Application Management

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Information Technology

Happy employees make productive employees. HR managers are now finding that compensation and benefits alone cannot keep employees happy; they also need nurturing through proper training and development. Join the BrightTALK talent management community to learn how to engage and retain your best talent by providing them with the tools and rewards they need to enhance their performance and reach their potential.

Talent Management

Modern human resources professionals are charged with not only the recruitment of talent, but also retention, satisfaction and management. They also support the training, assessment and compensation aspects of employee management. Join this community to connect with thought leaders and learn about trends in benefits, compensation and talent management. Stay ahead of the curve to attract and retain top talent and strengthen organizational leadership and culture.

HR Strategy

Human resources is intrinsically linked to business success and requires a thoughtful balance of a variety of complex issues. The human resources community on BrightTALK is made up of thousands of professionals in human resources exchanging human resources best practices and advice. Watch hundreds of on-demand webinars for immediate information or participate in upcoming live webinars and have your questions answered by respected HR thought leaders.

Human Resources

Get powerful market trends insights that are shaping the M

The accounting and finance community on BrightTALK features presentations from leading accountants and finance professionals. The accounting community includes tax planning strategies, QuickBooks webinars and other accounting webinars, while the finance community features presentations on financial capital regulations and forensic data analytics. Join the conversation by attending live financial and accounting presentations and connecting with industry thought leaders.

M&A and Open Source During Uncertain Times

Presented by

About this talk

More from this channel