Securing Modern Applications: The Data Behind DevSecOps

Editor's Notes

• #3: 145m record 600k Gdpr number C suite retirement Learn facts – watch ilka vid & atch youtube
• #5: Say hello to YOUR software supply chain, not “the software supply chain”; personalizing it more for the audience. For those of you that are unfamiliar with a software supply chain, it's really an allegate to the traditional supply chains used in manufacturing today. Those supply chains have suppliers that are building components. In the case of software development, that is the open-source [projects 00:07:53] that are building components, and making them freely available to developers around the world. [00:08:00] They're able to store and distribute those components in the large central warehouses, like the central repository that Sonatype is responsible for managing, but also repositories like rubygems.org, [pipi.org 00:08:16], thenugetgallery, etc. This is where the components are stored and available to the manufacturers, that are really the software development teams, that are consuming these components and downloading these components over the years. Those components are then used to create the finished goods, or the software applications, that organizations are then delivering to their customers. We'll continue to use this supply chain analogy for the software supply chain, then compare and contrast what's happening in traditional manufacturing, is to what's happening in software today.
• #6: There's a really interesting site out there called moduleaccounts.com. It has a simple value, it keeps track of the number of different components, or packages that are available across the different development languages, from pipi, to nuget, to bower, to maven, components, etc. And it shows the increase in the number of these components that are available to the developer ecosystem, or the developer population, over time. We used some data from that site to see that over a thousand new open-source projects were created each day. People delivering a new kind of software, a new kind of component. Then, from the general population of all open-source projects worldwide, we were able to estimate that ten thousand new versions of components are introduced every day. There's this huge supply of components entering the ecosystem, and available to our software supply chains. When we look at the central repository that Sonatype manages, of maven style or java open-source components, we looked across 380 thousand open-source projects, and found that on average those projects were releasing fourteen new versions of their components every year. That's great from a supply chain aspect, that the suppliers are very active, actively releasing new software, actively releasing new innovations, and actively improving the software that they're making available to developers worldwide.  
• #12: Unfortunately, not all parts are equal... Some are healthy, some are not… …and all go bad over time (like milk, not like wine).
• #17:  in the late 1950s, and the dominance of car design over good engineering
• #18: [00:14:00] One of the things that we measured year over year, and we do do some year over year comparisons throughout the report, is that 6.2% of the downloads from the central repository last year out of the billions of downloads, had a known security vulnerability in them. This past year we saw 6.1% of the downloads had a known vulnerability. That's about one in sixteen of every component download has a known vulnerability in it.
• #20: [00:14:00] One of the things that we measured year over year, and we do do some year over year comparisons throughout the report, is that 6.2% of the downloads from the central repository last year out of the billions of downloads, had a known security vulnerability in them. This past year we saw 6.1% of the downloads had a known vulnerability. That's about one in sixteen of every component download has a known vulnerability in it.
• #23: in 2016 there were 197 GAVs related to bouncycastle downloaded a total of 23,412,020 times. 61 of thos GAVs were insecure, and those were downloaded 11,181,493 times
• #24: for commons-collection, there were 25 GAVs downloaded a total of 23,476,966 times.  7 of those GAVs were insecure, and those were downloaded 18,330,958 times.
• #29: “Cease dependence on mass inspection.” Inspection does not improve quality. Nor guarantee quality. Inspection is too late. Harold F. Dodge: “You cannot inspect quality into a product” Automatic inspection and recording require constant vigil.
• #31: Run through to CI / CD relatively quickly. 2min max. When there, focus on discussing * ‘what happens when we introduce the questions of ‘what about security vulnerabilities?’ ‘What about licensing?’ Most companies solve these manually. Takes long time. Ask the attendees how they deal with it? When you know, start explaining we believe these should be automated throughout the SLCD instead of being at the very beginning or very end. Reveal each label, discuss briefly implications BEGIN DEMO FLOW. Stop after each major theme briefly for questiosn IDE Policy Jenkins / Bamboo REPORT – Vulnerabilities – Licensing – important to know what persona to know what to focus on here JIRA – DASHBOARD AT THE END OF THE DEMO – ASK FOR THEIR IMPRESSIONS “And that’s the end of the demo. What do you think, could this be useful?” => Helps set the stage for value affirmation and future next steps
• #32: “Cease dependence on mass inspection.” Inspection does not improve quality. Nor guarantee quality. Inspection is too late. Harold F. Dodge: “You cannot inspect quality into a product” Automatic inspection and recording require constant vigil.
• #33: The question is not:Can we build secure software?
• #34: Fannie mae? LM – R !LC 34,000 – amex? 48% FM?
• #35: This should be at the beginning and end of your presentation: What are the three talking points your audience should be able to answer after this presentation?