While software grows more complex and the pace of development accelerates, the stakes for building secure software have never been higher. If you’re like most teams embracing a DevOps culture, you’re focused on breaking down silos, streamlining workflows, and cranking out functional software at a nearly continuous clip. Amid all these fundamental changes, how do […]
Continue Reading...
Posted in CI/CD, DevOps, Software Composition Analysis, Static Analysis (SAST) | Comments Off on Webinar: Ensure your software is secure without clogging up the CI/CD pipeline
How can you not love customer feedback when it helps you improve your product? At our recent FLIGHT conference, I had the opportunity to speak to a lot of customers, plus detailed discussions with our Customer Advisory Board members. This knowledge helped us build out the latest release of Black Duck Hub with new features […]
Continue Reading...
Posted in Black Duck by Synopsys, Open Source Security, Software Composition Analysis | Comments Off on Customer driven features live in Black Duck Hub 4.4 release
Originally posted on SecurityWeek. After going through 24 seasons of cross-country, winter track, and spring track with my boys, I fully understand that if you put your toe on the line, you had better be prepared to race, or bad things happen. As the use of open source continues to rise, many organizations are putting […]
Continue Reading...
Posted in Data Breach, Open Source Security, Software Composition Analysis | Comments Off on Open source vulnerabilities: Are you prepared to run the race?
Much of today’s software is created using third-party code, and why not? After all, it’s quicker and more cost effective than building it from scratch. Using third-party software, however, comes with its own challenges. The recent State of Software Composition Analysis 2017 report explores these challenges. The report is based on the analysis of 128,782 software […]
Continue Reading...
Posted in Open Source Security, Software Composition Analysis | Comments Off on Webinar: Do you know what’s in your software?
For years, free and open source software (FOSS) has a had a negative connotation, with some developers forbidden to use it in final software product releases. The obvious downside in avoiding open source is that organizations run the additional risk of introducing avoidable vulnerabilities. For example, an organization with no cryptographic experience should not be […]
Continue Reading...
Posted in Open Source Security, Software Composition Analysis | Comments Off on The pros and cons of adding open source to your software
Fault Injection is a podcast from Synopsys that digs into software quality and security issues. This week, hosts Robert Vamosi, CISSP and Security Strategist at Synopsys, and Chris Clark, Principal Security Engineer at Synopsys, go into detail about a new report: The State of Software Composition 2017. You can always join the discussion by sending us […]
Continue Reading...
Posted in Application Security, Open Source Security, Software Composition Analysis, Vulnerability Assessment | Comments Off on Fault Injection Podcast .002: What’s in your software?
Software quality and security assurance both concern risk to the organization, but they do so for different reasons. Risk might be mission critical such as software on a scientific robot crawling another planet. Or risk might be associated with sensitive financial information. In the first example the integrity of the software is paramount; it is […]
Continue Reading...
Posted in Code Review, Secure Coding Guidelines, Security Risk Assessment, Software Composition Analysis, Software Security Testing, Vulnerability Assessment | Comments Off on Does software quality equal software security? It depends.
You can integrate SCA with your DevOps environment if you choose your tools wisely. Last month Forrester Research published their first-ever Wave for Software Composition Analysis (SCA). Wave’s provide enterprise IT and development teams with Forrester’s assessment of the state of the vendor landscape, grading vendors on their strategy, solution, and market presence. Vendors are […]
Continue Reading...
Posted in Agile Methodology, DevOps, Software Composition Analysis | Comments Off on Is software composition analysis compatible with Agile DevOps?
For the last six months, Forrester Research has been gathering and analyzing comparative information on technology vendors — including Black Duck — that provide Software Composition Analysis, an increasingly important job in helping organizations secure their software applications.
Continue Reading...
Posted in Open Source Security, Software Composition Analysis | Comments Off on Spotlight on open source AppDev preeminence driving change
When it comes to software vulnerabilities, Dr. Jared DeMott knows his stuff. Formerly a vulnerability analyst with the National Security Agency (NSA), Dr. DeMott holds his Phd. from Michigan State University. He has been on three winning DEF CON capture-the-flag (CTF) teams and talks about his vulnerability research at conferences like DerbyCon, BlackHat, ToorCon, GrrCon, […]
Continue Reading...
Posted in Application Security, Code Review, Fuzz Testing, Software Composition Analysis, Software Security Testing, Static Analysis (SAST), Web Application Security | Comments Off on Bug elimination: Code scanning, fuzzing, and composition analysis
