DevOps World | Jenkins World 2019 San Francisco

Open source usage has become a mainstream practice — it’s impossible to keep up with today’s pace without it. The rise in open source usage has led to a dramatic rise in the number of open source vulnerabilities, and the trend continues. Development teams are challenged to meet security objectives, without compromising on speed and quality.

Learning outcomes from this session:

• Learn about the current state of open source vulnerabilities management 
• Learn why developers struggle to handle open source vulnerabilities 
• How to step up your open source security game 
• The key strategies for effective vulnerability management

Open Source is an integral part of Application Development today. Although most of it is good, some are malicious and vulnerable. How do you automatically and contextually enforce policies (Security, License & Architecture) across the entire software development lifecycle and manage risk better without compromising the developer experience?

Development teams are facing an unprecedented challenge to accommodate requirements of application security while maintaining an agile development process. Reports of data breaches affecting organizations, services and millions of consumers worldwide, underscored the criticality of security in general and resulted in an unprecedented attention to application security vulnerabilities in particular.

In this session, we will present the latest insights and recommendations for improved security vulnerability management based on a comprehensive research that encompassed a survey of over 650 developers, as well as data culled from repositories and security advisories.

We'll discuss how developers in different regions, industries and organizations... 

• Are coping with the rising number of reported open source security vulnerabilities 
• Rate the types of challenges they are facing 
• Are allocating time to deal with security vulnerabilities 
• Are prioritizing security vulnerabilities to accommodate delivery objectives with timing constraints 
• How the concept of vulnerability effectiveness can potentially help developers reduce the effort required to deal effectively with open source security vulnerabilities