Managing Vulnerabilities through SSDLC
summary
Canonical implements a company-wide SSDLC that combines an in-house threat‑modeling method for open source (draw explicit asset graphs with crown jewels and stepping stones), CI‑integrated static analysis (Bandit cited as an example) to track code quality, multiple off‑the‑shelf vulnerability scanners per artifact with mandatory per‑release scans and periodic rescans until EOL, and threat‑led penetration tests (required by EU DORA in finance). Vulnerability handling runs as business‑as‑usual with documented lifecycles, prioritization and GitHub security advisories for embargoed disclosure.
AI-written summary · about
chapters (13)
- 0:00SSDLC and cyber threats
- 1:51Canonical's SSDLC process
- 3:15Threat modeling methodology
- 9:00Threat modeling best practices
- 18:17Static code analysis in CI
- 19:23Vulnerability scanning for artifacts
- 21:58Penetration testing scope
- 23:02Vulnerability response process
- 24:51Prioritizing disclosed vulnerabilities
- 26:41Communicating vulnerabilities
- 27:24Security documentation in SSDLC
- 28:49Key security documentation elements
- 30:13Q&A
related talks
13mManaging Vulnerabilities in Open-Source Dependencies
33mVulnerability Management Lifecycle in DevSecOps
23mAdvanced Vulnerability Management in Cloud Foundry - Molly Crowther & Stephen Levine, Pivotal
27mEffective Vulnerability Management for a DevSecOps Pipeline
45mSimplifying Coordinating Vulnerabilities & Disclosures in Open Source...
40mDevSecOps Guide to Bulletproof Your Development Workflow
44mVulnerability Management that developers won't hate
44mProtecting Customers Through Smarter OSS Management