Open source in the enterprise
summary
Claims that an OSPO plus GitHub tooling gives enterprise-scale visibility into open source risk and dependency use and demonstrates it with a live dependency insights feature. Demo shows Lodash stats — 280 contributors and 3.5 million users — and flags that 99% of projects use OSS. Example component (Action View) has two security advisories and a CVE with fixes and workarounds; cross-org search surfaces GPL v3 usage so teams can prioritize remediation.
AI-written summary · about
chapters (7)
- 0:00Introduction and welcome
- 1:05Alaska earthquake story analogy
- 5:30Open source security risks
- 8:55Role of an OSPO
- 12:17Dependency insights demo
- 16:20Preparing for security breaches
- 18:19Future of open source tools
related talks
28mGoverning Open Source in the Enterprise: OSPO Strategies for Innovation and Compliance
41mManaging the risk and growth of using Open Source Software
45mOpen Source on Purpose; Strategy, Process and Tools to Succeed
30mA Lawyer and an Engineer Walk Into a Bar and Talk Open Source
39mSOS: Sustainable Open Source
31mThe Value of OSS Management for Risk Mitigation
42mAssessing the Risk of Open-source Components Using OpenSSF's Scorecard
13mWelcome