How secure are your open source-based systems?

The use of open source in federal systems is attracting scrutiny. In December, House Committee on Foreign Affairs Chairman Ed Royce (R-Calif.) and Rep. Lynn Jenkins (R-Kan.) introduced the Cyber Supply Chain and Transparency Act of 2014 (H.R. 5793) that would have required any supplier of software to the federal government to identify which third-party and open source components are used and verify that they do not include known vulnerabilities for which a less vulnerable alternative is available. One way to check if your systems are comprised is with an Application Health Check that provides a free breakdown of every component in an application and alerts IT managers to potential security and licensing problems.

more
Gartner logo

DevNexus

Date: March 10-12, 2015
Location: Atlanta, GA

DevNexus is the premier conference for professional software developers who want to hear from and interact directly with internationally acclaimed presenters and technologists. While you’re here, you’ll also connect with like-minded developers who are mastering their craft in a wide range of today’s most relevant technologies and have the chance to hear Sonatype's Mark Miller present his talk entitled "Wait Wait, Don't Pwn Me!"

more
InfoSec logo

InfoSecurity EU

Date: June 2-4, 2015
Location: London, UK

Infosecurity Europe is Europe's number one information security event. Featuring over 345 exhibiting vendors and services suppliers with the most diverse range of new products and services, an unrivalled education program and over 15,000 industry professionals travelling from over 70 countries, it is the most important date in the calendar for Information Security professionals across Europe. Visit Sonatype at booth G172.

more
Gartner logo

Gartner Security & Risk Management Summit

Date: June 8-11, 2015
Location: National Harbor, MD

This year’s Gartner Security & Risk Management Summit shows you how to find the balance between enabling your organization to move forward against its objectives while also protecting it, your customers and employees, so you can have faster business process and improved ROI. You’ll gain a comprehensive outlook into the full spectrum of security and risk management emerging trends and market scopes within five role-based programs and a dedicated Technical Insights track.

more
OWASP logo

OWASP AppSecEU 2015

Date: May 19-22, 2015
Location: Amsterdam, NL

OWASP AppSecEU is the premier gathering place for executives from Fortune 500 companies and technology thought leaders. It offers cutting-edge research presented by security professionals across Europe, trainings and speeches on a variety of security topics including: cloud security, mobile security, vulnerability analysis, and much more. There will be small group sessions, workshops, and learning opportunities for developers, business owners, and security experts. Learn and network for four days, while discovering Amsterdam!

more
RSA Conference

RSA Conference

Date: April 20-24, 2015
Location: San Francisco, CA

RSA Conference is helping drive the information security agenda worldwide with annual industry events in the U.S., Europe and Asia. Throughout its history, RSA Conference has consistently attracted the world's best and brightest in the field, creating opportunities for conference attendees to learn about IT security's most important issues through first-hand interactions with peers, luminaries and emerging and established companies. As the IT security field continues to grow in importance and influence, RSA Conference plays an integral role in keeping security professionals across the globe connected and educated.

more
Sonatype Webinar

Cyber Startup Summit

Date: January 28-30, 2015
Location: IDEALondon | Google Campus

The Cyber Startup Summit has the primary focus to promote innovation across cyber security. It is to enable collaboration between enterprise security leaders, security startups, creative entrepreneurs, students and academics to discuss, connect and hack the hot topics within the world of cyber security.

more

US Congress Intervenes to Address Cyber Security Crisis with Software Supply Chain Focus; Sonatype Introduces Free Application Health Check to Support Government Agencies and Software Providers

Fulton, MD – December 10, 2014 – Sonatype, a software company that enables developers to easily build software applications while significantly reducing security, compliance, and licensing risks, today released a free Application Health Check to immediately alert federal agencies and software suppliers about known vulnerable open source components and where they exist within an application.

more

Sonatype CTO Honored as Thought Leader

The most popular phrase to come out of the Spider-Man stories—“With great power, comes great responsibility”—hit close to home for Joshua Corman, CTO at Sonatype, who longed to be a superhero at a young age, but settled for being a protector in the IT security world. Corman believes that great power comes from protecting technology. Exposed to technologies at a young age by his father—whom he cites as an inspiration—Corman's interest grew into a successful career where he is considered a respected innovator.

more

Sonatype’s New Software Release Determines OSS Risk and Provides Immediate Path to Resolution

Fulton, MD – November 17, 2014 – Sonatype, a software company that enables developers to easily build software applications while significantly reducing security, compliance, and licensing risks, today released a new version of its Component Lifecycle Management (CLM) software. An industry first, developers can now avoid security risks without missing business-critical delivery deadlines.

more

Sonatype aims to help developers reduce risk from open-source components

Software developers use a large number of open-source components, often oblivious to the security risks they introduce or the vulnerabilities that are later discovered in them.

Sonatype, a company that helps developers manage open-source components across different applications, attempts to solve this long-standing problem with a new version of its Component Lifecycle Management (CLM) product, released Friday.

more

Nexus Live: October 9, 2014 1:00pm EDT, TheNEXUS Community Sneak Peak

On-Demand Recording: Streamed October 9, 2014

During the October 2014 broadcast of Nexus Live we were able to catch up with Gene Kim and Josh Corman to find out what’s in store for the DevOps Enterprise Summit in the Bay Area at the end of the month. We also took a quick look at TheNEXUS, the new community site for Nexus, Nexus Pro and CLM. Take a look.

more

Sonatype Brings NuGet Component Management to .NET Developer Community

Fulton, MD – October 1, 2014 – Sonatype, a software company that enables developers to easily build software applications while significantly reducing security, compliance, and licensing risks, today announced free NuGet package support through its open source component manager – Nexus OSS. As developers are consuming an ever-increasing number of open source components -- now approaching 250 million downloads annually – the .NET community is seeking to improve build performance and stability through the use of component managers. This trend mirrors the evolution in the Java development environments where there are 13 billion open source component download requests managed annually. More than 40,000 organizations and teams seeking to improve their open source development performance and security have turned to Sonatype’s Nexus component managers -- all of which can now leverage available NuGet support.

more

Fixing HealthCare.gov security

In a report released Tuesday, the Government Accountability Office found problems in the "technical controls protecting the confidentiality, integrity and availability" of the federally facilitated marketplace (FFM), which is the area of the site to buy health insurance.

more
Sonatype Webinar

ISSA Webinar: What's in your Software? Identifying Open Source Vulnerabilities

Date: September 23, 2014
Time: 12:00pm EDT

New software enters our security ecosystems daily. When we evaluate the software we look for vulnerabilities in the product. Of course we run functional tests, or break out our favorite scanner, to see if there is embedded malware or dangerous deployment requirements, or even bugs in the program. When done, it gets deployed. What happens after deployment is important, but also gets missed. Of course we will catch new vulnerabilities that are directly related to the product, but what about vulnerabilities in the third party components included in the product? Recently this point was driven home by the numerous vulnerabilities in OpenSSL. Most people usually hear about it when it comes as an update from the vendor. What can you do about it? This panel will leverage the insight from seasoned industry leaders as we hear their thoughts.

more
Sonatype Webinar

Webinar: See the Sonatype Product Roadmap Revealed

Original Broadcast Date: September 25, 2014

For years, development teams and now security professionals have looked to Sonatype for better management of open source and third party components across the software supply chain. Watch our live product roadmap discussion to learn more about our commitment to helping you achieve real business value from your enterprise applications more quickly - with efficiency, quality and security addressed across the software lifecycle. See how with new product advancements for more component languages, a consolidated risk management dashboard and expanded integration points across the SDLC can bring your organization enterprise-class component management to your development operations.

more

Hackers breach security at Healthcare.gov

Hackers breached security at the website of the government’s health insurance marketplace, HealthCare.gov, but did not steal any personal information on consumers, Obama administration officials said Thursday.

more

Almost Too Big to Fail

Both dependence on open source and adversary activity around open source are widespread and growing, but the dynamic pattern of use requires new means to estimate if not bound the security implications. In April and May 2014, every security writer has talked about whether it is indeed true that with enough eyeballs, all bugs are shallow. We won't revisit that topic because there may be no minds left to change.

more

Old Apache Code at Root of Android FakeID Mess

A four year-old vulnerability in an open source component that is a critical part of Google’s Android mobile operating system could leave mobile devices that use it susceptible to attack, according to researchers at the firm Bluebox Security.

more

Over 370 Organizations Report Confirmed or Suspected Open Source Breaches in Past 12 Months According to Sonatype Survey

FULTON, MD (July 22, 2014) – Three out of four organizations that build software applications either have failed to adopt policies to prevent the use of vulnerable software components or have neglected to ban even a single component to enforce existing policies, according to a new survey. In the survey 3 out of 10 respondents actually admitted they either had or suspect a breach was caused by an open source component within the last twelve months.

more

5 big security mistakes coders make

Hacks make headlines. But usually, the focus is on who did it – notorious cyber criminals, hacktivists, or state-sponsored actors. Readers want to know who they are, where they're from, what they did, and why they did it. Howthey did it gets glossed over.

In fact, the "how" is the most important part – and application vulnerabilities are common culprits. What's number one on the list? Trusting third-party code that can't be trusted.

more

Researchers Track Spread of Security Flaws in Software Libraries

More than 200 software products rely on a flawed OpenSSL component, which exposed users to attack until vendors patched the software. The well-known incident highlights the trouble with security vulnerabilities in popular infrastructure software, frameworks and libraries, including popular software components—including LibPNG, used by more than 130 popular software products, and FreeType, used in more than 30 applications.

more
Sonatype Webinar

Webinar: Open Source Development and Application Security Survey: The Results are In!

Over 3,300 participated! The final results of our 4th Annual Open Source and Application Security Survey are in. Adrian Lane from Securosis and Brian Fox from Sonatype provide a detailed breakdown of the findings from a developer and an application security perspective. They discuss policies, practices, and breaches as well as how organizations can use these results to create constructive conversations to feed their open source security management practices.

more

Awards

Codie INC 500 Red Herring SD Times NVTC RSA Gartner