Your Applications are Under Attack: Protecting each step of the development lifecycle
summary
Claims that developer supply chains are under active attack and that protection must be concrete not rhetorical. Shows a live struts2 RCE exploit worked against a Dockerized app built with Maven and exploited via a Python payload, demonstrates scanning with Clair and GitHub/ECR, and describes tooling: OSS Index, VS Code extension, Nexus Platform (repository manager, Firewall, IQ). Gives numbers: 90% of app is open source, one in ten components has a vulnerability, and shows Nexus Platform quarantines bad components to block builds.
AI-written summary · about
chapters (7)
- 0:00Start
- 5:06It's no secret... developers use open source software.
- 6:32How Enterprise Manage Dependencies LAST YEAR
- 29:42But this is only a workshop....
- 31:17What does GitHub say?
- 49:55Open Source Governance for the Enterprise Analyze and enforce policies automatically
- 50:58EARLY
related talks
32mTutorial: Yes, Your Applications are Under Attack - Struts2 Vulnerability Workshop
11mIdentifying Security Vulnerabilities at Scale: Venture Inside a Pipeline
46mLive hacking: Breaking into your Java web app
52mDevSecOps
41mLive Hacking: Breaking into Your Web App
40mEmbracing Security - A Changing DevOps Landscape
50mStranger Danger: Your Java Attack Surface Just Got Bigger
40mSecuring your dependencies