Say Vulunerabilities One More Time - Ending Open Source Security Fatigue
summary
Explains that the answer is process not panic and gives concrete measures: recall Struts Equifax and Log4j where 91% of Java apps had the library and 61% indirect dependencies surprised teams, so focus on measurable triage steps: prioritize internet-facing services, add short-term mitigations like WAF rules or vendor filters, accelerate CI CD so fixes roll fast and avoid blocking pipelines with rigid quality gates, and treat remediation as tracked backlog work rather than emergency shutdowns.
AI-written summary · about
chapters (8)
- 0:00Open source security fatigue
- 1:13Personal journey and aviation
- 4:01Boeing 737 Max 8 failure
- 6:11Major open source vulnerabilities
- 9:24Log4Shell and Spring4Shell
- 10:50Why security keeps driving developers crazy
- 13:17From eradication to resiliency
- 16:05Summary and Churchill’s wisdom
related talks
32mBuilding a secure future using DEVSECOPS practices and technologies
40mEmbracing Security - A Changing DevOps Landscape
26mStop Hitting Yourself: How to Prevent Common Attacks to your Application
41mThe Divine and Felonious Nature of Cyber Security
39mWe Are All Equifax: The Data Behind DevSecOps
50mStranger Danger: Your Java Attack Surface Just Got Bigger
56mThe Anatomy of Java Vulnerabilities
27mSecurity: The Thing That Everyone...