OWASP A9: A Year Later - Are you still using components with known vulnerabilities?
summary
OWASP added A9 last year to call out apps assembling opaque third‑party code; Sonatype data shows Maven Central (~600k components) and ecosystems like npm/nuget growing fast, many packages downloaded millions of times. A survey of ~3,300 developers finds only 21% must prove they are free of components with known vulnerabilities, and measured mean time to repair 391 days for upstream projects to fix first‑level dependency flaws. Recommends inventories/SBOMs and automating dependency monitoring.
AI-written summary · about
chapters (22)
- 0:00Introduction
- 4:09Web frameworks
- 5:13Awareness
- 7:11Central
- 10:55Open Source
- 12:32Heartbleed
- 14:33Vulnerability Awareness
- 14:47Do they really care
- 17:21The proof is in the pudding
- 19:52Websphere
- 23:28Supply Chain Mechanics
- 25:24Application Development
- 26:58Policy
- 28:46Component Crack Cocaine
- 30:55Application Training
- 31:13Licensing
- 31:31Virus
- 33:24XML
- 35:43Undesirable
- 36:26I am
- 38:48Bacon
- 39:34Beer and Soda
related talks
48mAn Introduction to the Newest Addition to the OWASP Top 10
49mThe 2013 OWASP Top 10
32mAdapting DevOps in a World of Growing Software Supply Chain Attacks
31mOpen Source Supply Chain Threat Landscape - A Moving Target
37mThe Death Star and the Ultimate Vulnerability
14mThe State of Open Source Vulnerabilities Management in 2019
40mEmbracing Security - A Changing DevOps Landscape
25mOWASP Top 10 Risks for Open Source Software