Addressing Cybersecurity Challenges in Open Source Software

Conference: SupplyChainSecurityCon 2022

2022-06-21

Authors: Matt Jarvis, Steve Hendrick

Summary

The main theme of the conference presentation is the importance of involving developers in improving security knowledge and leveraging specialized security tools to automate security processes in DevOps. The presentation also emphasizes the need to rely on vendors for guidance and to follow best practices for security policy.

Involving developers in improving security knowledge and empowering them to make decisions based on guidance and feedback can be effective in improving security posture.
Leveraging specialized security tools, such as FAST, is crucial for providing guidance and insight for identifying security risks.
Relying on vendors for guidance and help in solving security problems is necessary due to the complexity of identifying security risks.
Automating security processes is essential for addressing security issues without impacting the speed of innovation.
Following best practices for security policy, such as those provided by the Linux Foundation's Secure Software Development course, can help organizations understand their current security posture and improve it over time.

The speaker mentioned that involving developers in security knowledge and decision-making can be effective in improving security posture. By providing guidance and insight, developers can make informed decisions and solve security problems more effectively. This approach empowers developers to become security individuals and helps organizations scale their security processes.

Abstract

Organizations of all sizes are heavily reliant on software, and much of that software supply chain consists of open source software components. Because of this, open source software has cybersecurity implications: the software supply chain is an attractive entry point for people and organizations interested in theft, disruption, or exploitation for economic or political gain. Join Steve Hendrick (Linux Foundation) and Matt Jarvis (Snyk) as they discuss the latest OpenSSF cybersecurity research which describes where organizations are today in their cybersecurity journey and what can be done to improve the cybersecurity profile of open source software going forward.

Materials:

Tags: