Name: How to Efficiently Manage OSS Security and Compliance Across Teams
Start: 2021-01-14T18:00:00Z
End: 2021-01-14T18:00:51.000Z
Location: BrightTALK
Rating: 4

Up to 90% of any piece of software is from open source, creating countless dependencies and areas of risk to manage. FOSSA is the most reliable automated policy engine for vulnerability management, license compliance, and code quality across the open source stack. With FOSSA, engineering, security, and legal teams all get complete and continuous risk mitigation for the entire software supply chain, integrated into each of their existing workflows.

Generative AI tools like GitHub Copilot have become increasingly popular in software development, and for good reason. Multiple reports have shown that tools like Copilot can significantly improve development efficiency and increase developer satisfaction, among other benefits.

At the same time, some engineering organizations have understandably been reluctant to adopt generative AI tools because of uncertainty around potential security, legal, and data privacy risks involved.

Join FOSSA Senior Software Engineer Jessica Black in our upcoming webinar for more context on these potential risks and guidance for addressing them. Jessica, who is leading FOSSA’s generative AI risk management feature development, will cover both technological and strategic solutions, including:

-Strategies to improve maintainability and code privacy when using generative AI code-generation tools
-How to use FOSSA’s generative AI risk-management features to understand and manage security and legal risks
-GitHub Copilot settings that can guard against potential legal and privacy risks
-Best practices for integrating GitHub Copilot risk management processes throughout the software development lifecycle

The GitHub Copilot Risk Management Playbook

Generative AI tools like GitHub Copilot have become increasingly popular in software development, and for good reason. Multiple reports have shown that tools like Copilot can significantly improve development efficiency and increase developer satisfaction, among other benefits.

At the same time, some engineering organizations have understandably been reluctant to adopt generative AI tools because of uncertainty around potential security, legal, and data privacy risks.

Over the past months, FOSSA has been working to develop product functionality to help our customers manage these potential risks. Learn about these new features — and get big-picture guidance on generative AI risk-management best practices and processes — in this webinar with Senior Software Engineer Jessica Black, who is leading FOSSA’s generative AI risk management feature development.

Jessica will discuss:

-Design principles behind FOSSA’s new generative AI risk-management features
-How to use FOSSA’s generative AI risk-management features to understand and manage security and legal risks
-Strategies to improve maintainability and code privacy when using generative AI code-generation tools
-GitHub Copilot settings that can guard against potential legal and privacy risks

Managing GitHub Copilot Security and Legal Risks with FOSSA

Kodiak Robotics is a leader in the autonomous vehicle space, offering a variety of solutions to enable self-driving trucking and ground autonomy solutions for national defense. As you might expect from a company that delivers game-changing new technologies, Kodiak prides itself on efficient and effective product and software development. That includes using a large volume of open source software — and doing so responsibly, with risk management processes and tools that don’t slow innovation. 

Join Kodiak’s General Counsel, Jordan Coleman, and Software Engineer, Dhruv Patel, to uncover the key ingredients of Kodiak’s open source management program, including how the company:

-Effectively harnesses the power of open source software across its software stack
-Moved from a manual system of managing open source license compliance to an automated one, significantly reducing the burden on legal and engineering teams
-Enables engineering to use new open source libraries without waiting for explicit permission from legal — but still with legal’s blessing
-Maintains the software transparency required to do business with government customers

How Kodiak Robotics Automates Open Source Management

SBOMs (software bill of materials) have become an increasingly important tool for organizations looking to strengthen software supply chain management and transparency. They play a vital role in initiatives like supply chain security, regulatory compliance, customer requests, and open source license compliance, among other areas.

But given the complexity of modern applications, it can be very hard to maintain an effective and efficient SBOM program without the right tools. Join senior product manager Cortez Frazier Jr. in the webinar “Generating, Importing, and Managing SBOMs with FOSSA” for a workshop-style presentation on using FOSSA to handle SBOM essentials. 

We’ll show you how you can:

-Generate SBOMs in multiple formats, including SPDX and CycloneDX
-Import third-party SBOMs to gain visibility into supply chain security risks
-Manage all SBOMs on an ongoing basis to stay on top of application security threats
-Host and distribute SBOMs for third-party use

Generating, Importing, and Managing SBOMs with FOSSA

Maintaining compliance with open source licensing requirements is an essential part of software development, but it can often be easier said than done. That’s because the typical modern application is built with approximately 90% open source components, which means a lot of different licenses, obligations, and, in some cases, manual work.

Fortunately, tools exist to make compliance much easier than it was a decade ago. Join us in the webinar "Automating Open Source License Compliance Essentials" to see how your organization can use FOSSA to automate important compliance processes, including the ability to: 

-See all open source license obligations for a given application in one place
-Fulfill license notice and attribution requirements
-Customize and implement compliance policies (which ensures you won’t inadvertently distribute a product under a license you don’t allow)

Automating Open Source License Compliance Essentials

SPDX (Software Packet Data Exchange) is a widely used software bill of materials (SBOM) specification. It’s one of two full-stack SBOM standards approved under the U.S. government’s 2021 cybersecurity executive order, and it supports a number of important software supply chain management use cases.

Although SPDX has been around for over a decade (the original v1.0 was released in 2011), the specification has evolved significantly over the years, up to the current v2.3. Today, organizations can leverage SPDX to support a broad range of initiatives (including supply chain security), with a wide range of customizations and formatting options. 

Join Gary O’Neall, Tech Team Lead at SPDX, for a webinar on the specification, its evolution, and best practices for using it efficiently and effectively. We’ll discuss:

-The SPDX big picture: document structure, file formats, and internal vs. external SBOMs
-Typical SPDX data fields: required minimum elements, recommended elements, and useful add-ons
-SPDX security use cases and how the current v2.3 supports them
-Strategies for generating and maintaining SPDX SBOMs

An Insider’s Guide to SPDX

The NIS2 Directive is a new, wide-ranging EU cybersecurity law that includes regulations on incident response, software supply chain security, multi-factor authentication, risk analysis, and more. The Directive will take effect in October 2024 and will apply to more organizations (and include more requirements) than the EU’s current cybersecurity regulations (NIS). 

Join GlobalDots (a leading cloud and performance optimisation partner) during this webinar to review the Directive, with a particular focus on software supply chain security regulations and steps your organization can take now to enable compliance. We'll discuss:

-NIS2 requirements, scope, and implementation timeline
-Differences between NIS2 and NIS
-NIS2 software supply chain security requirements
-Tools, strategies, and processes to enable compliance with supply chain security regulations

NIS2 Directive: Understanding and Complying with Supply Chain Security Guidance

Although there are some universal rules of open source license compliance — like avoiding conflicts with GPL — there’s also plenty of nuance. 

Deploying software today is a mix of on-premises, SaaS, mobile, containerization, and edge computing. Your open source policy may not be one-size-fits-all.

How should your policies differ based on deployment model? What about applications built with generative AI? And, how do you implement these policies in a way that works for engineering teams? 

Join Heather Meeker, one of the world’s foremost open source software licensing experts, in our upcoming webinar for answers. Heather will cover a number of important compliance policy considerations, including:

-Customizing policies for common software deployment models and your work environment
-Strategies for effectively implementing policies — and reducing friction between legal and engineering teams
-Best practices for applications built with generative AI tools like GitHub Copilot
-Creating rules for SaaS, mobile, on-premises, containers, and edge computing

Customizing Your Open Source Compliance Policy, Featuring Heather Meeker

Since launching in 2017, CycloneDX has gained popularity as a lightweight software bill of materials (SBOM) specification. And, that growth has only accelerated in the months since CycloneDX was highlighted in the U.S. government's 2021 cybersecurity executive order as an approved SBOM export format.

Join Steve Springett, Chair of the CycloneDX Core Working Group, for an in-depth look at the current state of the specification — and for practical guidance on using CycloneDX in your organization. We'll discuss:

-Elements of a CycloneDX SBOM
-Top CycloneDX SBOM use cases
-CycloneDX vs. SPDX and other popular SBOM formats
-Best practices for generating and importing CycloneDX SBOMs

Understanding and Using the CycloneDX SBOM Standard

Note: This is the replay of a webinar that originally aired on Nov. 16, 2022. 

Today, nearly every company that builds applications uses open-source software — and the majority of organizations use significant amounts of it.

Although the explosive growth of open source has yielded numerous benefits (including cost savings and faster time to market), it's also led to increased scrutiny of OSS license compliance (e.g. the ongoing matter of SFC v. Vizio). As a result, organizations without comprehensive compliance programs may face exposure to the legal, reputational, and financial risks that can come with non-compliance.
 
But while the license compliance field is still evolving, there are certain proven processes, tools, and workflows that can help organizations successfully manage compliance-related risk.
 
Join IP attorney Kate Downing, a leading expert in open-source license compliance, to uncover the key ingredients of a comprehensive, effective, and efficient compliance program. 
 
Kate will offer practical guidance on areas like:
-Implementing license/legal review processes that don't create a bottleneck for engineering 
-Creating attribution files for distributed products
-Preparing source code files (for compliance with copyleft licenses)
-Leveraging code scanning software
-Bringing these tools and processes together into a scalable, efficient, and effective program

The Lawyer's Guide to a Comprehensive Open Source Compliance Program

The software bill of materials (SBOM) landscape continues to evolve, with new tooling, standards, and use cases emerging each year. For 2023, we expect this to include a significant emphasis on importing third-party SBOMs, operationalizing vulnerability data across the SDLC, and distributing SBOMs in standardized formats.

Join FOSSA for our January 18 webinar discussion on important SBOM trends to track in 2023 — and steps your organization can take now to get ahead.

We’ll discuss:

-New standards and tools (like the CycloneDX SBOM Exchange API) that help standardize SBOM distribution
-Important considerations for ingesting SBOMs from third parties
-Maximizing the value of SBOM vulnerability information, including VEX (CycloneDX’s Vulnerability Exploitability eXchange)
-FOSSA’s new SBOM features, including support for importing and generating in the CycloneDX export format

SBOMs in 2023: Trends, Tools, and Capabilities

A recent Cloud Native Computing Foundation (CNCF) survey revealed that a staggering 84% of organizations use containers in production — up from only 23% a few years ago.

Like much of today’s technological landscape, the container ecosystem is largely fueled by open source components. This, of course, means organizations that use containers must be mindful of open source licensing requirements. But the complexity and relative novelty of the container environment means maintaining license compliance can be easier said than done. 

Join leading open source licensing expert Kate Downing and FOSSA’s engineering team on Dec. 19 for key insights on understanding and managing open source license compliance in the container environment. We’ll discuss:

-Which parts of the open source container ecosystem carry compliance obligations
-How to deal with copyleft-licensed components 
-End-to-end strategies for managing container-related compliance
-The role of container scanning in managing compliance

Containers and Open Source License Compliance

For all of the attention paid to SBOMs (software bill of materials) in recent years, there’s been little conversation about a mission-critical supply chain security use case: integrating SBOMs throughout the software development lifecycle. 

Instead, SBOMs are generated as a check-box item, placed in Google Drive — never to be seen again. Unfortunately, this misses an important opportunity to integrate SBOM insights (such as risk assessments based on SBOM data) into the SDLC.

Of course, successfully operationalizing an SBOM requires buy-in from the right stakeholders,  building the right SBOM-related workflows, and using the right tools — and this can be easier said than done.

Join Kenaz Kwa, the Head of Product at FOSSA, in our webinar “How to Get Value from SBOMs Throughout the SDLC” for practical guidance on tackling these challenges and successfully operationalizing your SBOMs. We’ll discuss:

-Best practices for generating SBOMs that can be used throughout the SDLC
-Considerations when importing SBOMs 
-How to use SBOMs to flag compliance and security issues during the early stages of the SDLC

How to Get Value from SBOMs Throughout the SDLC

As a technology-focused attorney with several leading software companies, Evan LeBon has had a front-row seat to the evolution of software development — and the profound impact it’s had on in-house counsel. 

The shift from a handful of releases each year to the modern world of dynamic build pipelines, automation, and CI/CD has forced legal teams to address a variety of new challenges. 

-How do you balance the need for product compliance and IP protections with engineering’s desire to move quickly?
-What’s the most effective way to structure communication and collaboration with modern development teams?
-How do you keep mission-critical documentation like SBOMs and open source attribution notices up to date?
-What new tools and processes are necessary to make all of this possible?

Evan will answer these questions and more on Wednesday, Nov. 2 during the webinar "Legal Compliance for Modern Software Development." We’ll discuss specific ways in-house counsel can ensure compliance processes keep pace with development, including:

-How understanding and embracing engineering culture can help in-house counsel work more effectively with development teams
-How open source license compliance management processes should evolve to keep pace with continuous software release cycles
-How automated tools can save legal teams significant time on compliance and documentation

Legal Compliance for Modern Software Development

Applause is the world leader in testing and digital quality. They partner with the world’s greatest brands — such as Google, Microsoft, and PayPal — to ensure that their digital assets and experiences are of the highest quality and work as intended.

Like a number of successful engineering leaders, Applause CTO Rob Mason has encouraged his team to use open source software to improve efficiency and product quality. But, Rob and Applause have taken a different, far more developer-friendly approach than many organizations to the necessary (yet often painful) areas of product compliance and security. 

With the right mix of policies, collaboration, and automation, Applause has built successful compliance and security programs that don’t take significant engineering resources or require developers to change their preferred workflows.

Join Rob in the upcoming webinar "How Applause Does Open Source Compliance and Security the Developer's Way" to learn more about Applause’s developer-first approach to managing OSS license compliance and security — and the importance of tools like FOSSA in making this possible. We’ll discuss:

-How Applause structured its OSS license compliance and vulnerability management programs to be as developer-friendly as possible
-Best practices for collaboration: engineering-legal (on license compliance) and engineering-security (on vulnerability management)
-How and where Applause uses scanning technologies to manage OSS license compliance and security
-How Applause has benefited from automating OSS license compliance and vulnerability management with FOSSA

How Applause Does Open Source Compliance and Security the Developer's Way

There's been a lot of discussion about SBOM-related requirements in the Biden administration’s 2021 cybersecurity executive order. But that same executive order also prompted NIST (the U.S. government’s National Institute of Standards and Technology) to create lesser-known — yet also important — guidance specific to managing open source software security. 

These recommendations include using programming languages and frameworks with built-in security controls, pulling open source from trusted repositories, and implementing software composition analysis (SCA) to detect vulnerabilities, to name a few.

Join FOSSA Security Engineering Manager Solomon Rubin in the webinar “Demystifying NIST’s Open Source Software Security Controls” for a comprehensive overview of NIST’s open source security recommendations — and the practical steps your organization can take to implement them. 

We’ll discuss: 

-NIST’s six recommended controls for open source software security
-How teams can use NIST’s Foundational, Sustaining, and Enhancing framework as a roadmap to enhance their internal capabilities 
-The role of SBOMs in vulnerability management 
-Where software composition analysis (SCA) tools like FOSSA fit into NIST’s guidance

Demystifying NIST’s Open Source Software Security Controls

SFC vs. Vizio — a case that tests whether software users (not just copyright holders) can enforce open source licenses — has the potential to change the open source enforcement landscape in a major way. If courts determine that users have standing to enforce the GNU General Public License, software developers who use open source code are likely to face significantly more compliance-related requests and scrutiny.  

In addition, the case has revived interest in an often overlooked provision of the GPL v3 which, regardless of the court’s decision on standing, is important for producers of consumer devices. The GPL v3 requires consumer device manufacturers to provide “installation information” so that end-users can update, modify, and/or reinstall the GPLv3 licensed software in those devices. 

But what is “installation information” and what’s the best way for manufacturers of “user products” to comply with this requirement — and what steps should organizations (regardless of industry) take now to bring their products into compliance? 

Join software licensing expert Chris Stevenson, Of Counsel (DLA Piper) on October 12 for a webinar discussion on these pressing questions and more. We’ll discuss: 

-An update on the SFC vs. Vizio and its potential ramifications
-Key differences between GPL v2 and GPL v3
-The “User Products” clause and strategies to comply with it

Compliance with the GPLv3 “User Products” Clause and the Impact of SFC v. Vizio

Growing threats from software supply chain attacks — coupled with new regulatory guidance from the U.S. federal government — have put a spotlight on the importance of generating SBOMs (software bill of materials). 

But while SBOMs are often mainly associated with supply chain security and regulatory compliance initiatives, they have a range of applications for today’s in-house legal teams, including OSS license compliance. 

Join Ryan Cobb, the IP Counsel at Okta, for a webinar discussion on what in-house counsel should know about SBOMs. 

We’ll discuss:

-How detailed SBOMs can be a competitive advantage for your organization
-The connection between generating SBOMs and maintaining OSS license compliance
-Getting engineering support for SBOM generation 
-Practices and processes for generating SBOMs

The In-House Counsel’s Guide to SBOMs

For modern product teams, trading off between productivity and efficiency is an absolute non-starter, especially when it comes to collaboration across different parts of the org. Working with open source software only complicates cross-functional workflows, since third-party code introduces so many variables and so much surface area for risk. 

In this webinar, leaders from UiPath will discuss the stream of interactions between Security, Engineering, and Legal in monitoring, investigating, and remediating open source vulnerability and license issues. We’ll cover how to promote joint SLAs and use automation tools like FOSSA, CI/CD pipelines, and tracking tools like Jira to reduce technical overhead and enable better results right in existing development processes. You’ll learn more about:
- Why Security should build pipelines for automated code SCA scans
- What info Legal needs to understand how OSS is used (e.g., repository structure)
- How to convey data to Engineering to resolve compliance and security issues earlier

How to Efficiently Manage OSS Security and Compliance Across Teams

Open Source

Security

Engineering

Legal IT

CI/CD

Monitoring

Remediation

Scans

Compliance

Workflows

Intellectual property law is crucial to ensuring that you or your organization have exclusive rights to that assets that you’ve created. The BrightTALK intellectual property community has thousands of professionals focused on learning and exchanging information about intellectual property management, intellectual property software and how to protect intellectual property. Join the community for access to free, interactive presentations or attend live webinars to have your questions answered by IP lawyers and industry experts.

Intellectual Property

The legal community on BrightTALK combines the fields of employment law, e-discovery, intellectual property and environmental law to create a thriving ecosystem of legal resources. Attend live and on-demand webinars dealing with employment contract law, e-discovery solutions, intellectual property software and sustainable development from leading lawyers and legal professionals to gain knowledge in a wide range of fields. Join the community and be part of the conversation by attending live legal webinars and connecting with industry thought leaders.

Legal

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

The application development community features top thought leadership focusing on optimal practices in software development, SDLC methodology, mobile app development and application development platforms and tools. Join top software engineers and coders as they cover emerging trends in everything from enterprise app development to developing for mobile platforms such as Android and iOS.

Application Development

Enterprise applications have become a crucial piece of infrastructure for many businesses. The enterprise applications community on BrightTALK features the latest insights in enterprise application integration, enterprise application architecture and EAS software. Join the community to gain access to thousands of videos and webinars presented by recognized enterprise information systems experts and arm yourself with the knowledge you need to succeed.

Enterprise Applications

Join thousands of engaged IT professionals in the application management community on BrightTALK. Interact with your peers in relevant webinars and videos on the latest trends and best practices for application lifecycle management, application performance management and application development.

Application Management

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Information Technology

Happy employees make productive employees. HR managers are now finding that compensation and benefits alone cannot keep employees happy; they also need nurturing through proper training and development. Join the BrightTALK talent management community to learn how to engage and retain your best talent by providing them with the tools and rewards they need to enhance their performance and reach their potential.

Talent Management

Modern human resources professionals are charged with not only the recruitment of talent, but also retention, satisfaction and management. They also support the training, assessment and compensation aspects of employee management. Join this community to connect with thought leaders and learn about trends in benefits, compensation and talent management. Stay ahead of the curve to attract and retain top talent and strengthen organizational leadership and culture.

HR Strategy

Human resources is intrinsically linked to business success and requires a thoughtful balance of a variety of complex issues. The human resources community on BrightTALK is made up of thousands of professionals in human resources exchanging human resources best practices and advice. Watch hundreds of on-demand webinars for immediate information or participate in upcoming live webinars and have your questions answered by respected HR thought leaders.

Human Resources

Get powerful market trends insights that are shaping the M

Mergers and Acquisitions

The accounting and finance community on BrightTALK features presentations from leading accountants and finance professionals. The accounting community includes tax planning strategies, QuickBooks webinars and other accounting webinars, while the finance community features presentations on financial capital regulations and forensic data analytics. Join the conversation by attending live financial and accounting presentations and connecting with industry thought leaders.

How to Efficiently Manage OSS Security and Compliance Across Teams

Presented by

About this talk

More from this channel