Dependency Management: Risk vs Crisis Management
summary
Argues that proactive risk management prevents legal and security crises by inventorying and tracking third‑party software, using pipeline‑integrated scanners and license tools, and applying clear policies and review gates. Cites real incidents — the Equifax breach and BusyBox litigation — and notes a service with 3,000 dependencies to show scale. Recommends choosing deps with high test coverage, explicit security response, replacing unmaintained libs, and using commercial or open tooling such as Black Duck or integrated OSS scanners.
AI-written summary · about
chapters (5)
- 0:00Intro
- 4:09What can go wrong
- 10:56Choosing the right dependencies
- 18:27Updating dependencies
- 21:36Conclusion
related talks
42mSponsored Session: Dependencies: Do's and Don'ts
25mYour Software Supply Chain is Only as Secure as its Weakest Link
38mDependency Management: The Cause of—and Solution to—All Supply Chain Problems
24mDependency Track Fortifying The Supply Chain
27mDependency hell - Or, Developers' perception of software dependencies
13mManaging Vulnerabilities in Open-Source Dependencies- 38mDependency Management: The Cause of—and Solution to—All Supply...
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance