A CISO having a bad day finds out the hard way that cutting corners on software security testing might end up costing him more than he saved.
Posted in Cloud Security, Interactive Application Security Testing (IAST), Maturity Model (BSIMM), Mobile Application Security, Open Source Security, Security Training, Software Architecture and Design, Software Composition Analysis | Comments Off on What happens when your CISO has one of those days?
How should you track open source? It’s almost definitely in your codebase, so the question is not whether to track it but what could happen if you don’t.
Posted in Open Source Security, Software Composition Analysis | Comments Off on You’re using open source software, and you need to keep track of it
Technical due diligence on the target’s SDLC is a must for acquirers in software M&A. What you don’t know about their process and tools could hurt you.
Posted in Mergers & Acquisitions, Open Source Security, Software Composition Analysis | Comments Off on Technology company M&A: Do due diligence on SDLC process/tools
Black Duck is among platforms that lead the pack, cited for “very strong policy management and SDLC integrations and strong proactive vulnerability management.”
Posted in News & Announcements, Open Source Security, Software Composition Analysis | Comments Off on Forrester recognizes Synopsys as a leader in software composition analysis
SCA tools are an essential part of your AppSec toolkit, because free and open source software—just like free puppies—comes with hidden costs and risks.
Posted in Agile, CI/CD & DevOps, Maturity Model (BSIMM), Open Source Security, Software Composition Analysis | Comments Off on The hidden costs and risks of free puppies (and open source)
Hacking Security is a monthly podcast on emerging trends in application security. Episode 3 explores key findings from the 2018 OSSRA report.
Podcast: Play in new window | Download
Posted in Mergers & Acquisitions, Open Source Security, Software Composition Analysis | Comments Off on Hacking Security Episode 3: OSSRA report findings
In the Synopsys Software Integrity Group, we test all our products against one another—turning our security into a force multiplier for our customers’ security.
Posted in Software Composition Analysis | Comments Off on Eating our own duck food: Software composition analysis in the Synopsys SDLC
The EventStream incident shows just how easily attackers can infiltrate the open source software supply chain by adding a malicious dependency to a trusted component.
Posted in Open Source Security, Software Composition Analysis | Comments Off on NPM dependencies, supply chain attacks, and Bitcoin wallets
The prevalence of open source is a potential M&A risk, as buyers are often not aware that more than 50% of the code they acquire is made up of open source.
Posted in Mergers & Acquisitions, Open Source Security, Software Composition Analysis | Comments Off on Open source security risk: Managing the threat in mergers and acquisitions
Open source is the foundation of most modern applications. However, left untracked, open source can put containerized applications at risk of known vulnerabilities such as Heartbleed and CVE-2017-5638 found in Apache Struts.
Posted in Container Security, Open Source Security, Software Composition Analysis | Comments Off on Securing containers at scale