Black Duck is among platforms that lead the pack, cited for “very strong policy management and SDLC integrations and strong proactive vulnerability management.”
Posted in Featured, Open Source Security, Software Composition Analysis | Comments Off on Forrester recognizes Synopsys as a leader in software composition analysis
SCA tools are an essential part of your AppSec toolkit, because free and open source software—just like free puppies—comes with hidden costs and risks.
Posted in Maturity Model (BSIMM), Open Source Security, Software Composition Analysis | Comments Off on The hidden costs and risks of free puppies (and open source)
Hacking Security is a monthly podcast on emerging trends in application security. Episode 3 explores key findings from the 2018 OSSRA report.
Podcast: Play in new window | Download
Posted in General, Open Source Security, Software Composition Analysis | Comments Off on Hacking Security Episode 3: OSSRA report findings
In the Synopsys Software Integrity Group, we test all our products against one another—turning our security into a force multiplier for our customers’ security.
Posted in Software Composition Analysis | Comments Off on Eating our own duck food: Software composition analysis in the Synopsys SDLC
The EventStream incident shows just how easily attackers can infiltrate the open source software supply chain by adding a malicious dependency to a trusted component.
Posted in Open Source Security, Software Composition Analysis | Comments Off on NPM dependencies, supply chain attacks, and Bitcoin wallets
I have blogged before about the pervasiveness of open source in applications today. Synopsys and other organizations have been tracking its growth for years, particularly as it relates to the amount of open source code we find in the applications we scan. Our Black Duck On-Demand Audit team scans thousands of applications every year, mostly in M&A scenarios. Many of our customers come to us during their due diligence efforts to offer a third-party assessment of the open source in a codebase, its related license obligations, and potential security risks. This audit data gives us a unique view of the open source landscape.
Posted in Open Source Security, Software Composition Analysis | Comments Off on Open source security risk: Managing the threat in mergers and acquisitions
Open source is the foundation of most modern applications. However, left untracked, open source can put containerized applications at risk of known vulnerabilities such as Heartbleed and CVE-2017-5638 found in Apache Struts.
Posted in Container Security, Open Source Security, Software Composition Analysis | Comments Off on Securing containers at scale
Interactive application security testing (IAST) and software composition analysis (SCA) are powerful technologies—and you need both in your security toolkit.
Posted in Agile, CI/CD & DevOps, Interactive Application Security Testing (IAST), Software Composition Analysis | Comments Off on The intersection between IAST and SCA and why you need both in your security toolkit
About a week ago, a security researcher disclosed a critical remote code execution vulnerability in the Apache Struts web application framework that could allow remote attackers to run malicious code on the affected servers. The vulnerability (CVE-2018-11776) affects all supported versions of Struts 2 and was patched by the Apache Software Foundation on Aug. 22. Users of Struts 2.3 should upgrade to 2.3.35; users of Struts 2.5 need to upgrade to 2.5.17. They should do so as soon as possible, given that bad actors are already working on exploits. More critical than the Equifax vulnerability “On the whole, this is more critical than the highly critical Struts RCE vulnerability that the Semmle Security Research Team discovered and announced last September,” Man Yue Mo, the researcher who uncovered the flaw, told the media, referring to CVE-2017-9805. CVE-2017-9805 was announced the same day (September 7, 2017) that Equifax announced the massive data breach via CVE-2017-5638, which led to the lifting of personal details of over 148 million consumers.
Posted in Data Breach, Open Source Security, Software Composition Analysis | Comments Off on CVE-2018-11776: The latest Apache Struts vulnerability
Taylor Armerding, Synopsys Software Integrity Group senior strategist, gives you the scoop on application security and insecurity in this week’s Security Mashup. What’s in this week’s Security Mashup, you ask? Lock the vote (election insecurity), “Spamalot” returns for a second act, and SamSam hits a grand slam as a heavy ransomware hitter.
Posted in General, Software Composition Analysis | Comments Off on Lock the vote, ‘Spamalot’ returns, and SamSam ransomware