Collaborate Disseminate
Hacking Security is a monthly podcast on emerging trends in application security. Episode 3 explores key findings from the 2018 OSSRA report. Hacking Security is a monthly podcast on emerging trends in application security development hosted by Steve G… Continue reading Hacking Security Episode 3: OSSRA report findings
Black Duck audit reports help you understand your license compliance, software security, code quality, and web services risks—and now they’re even better. Our customers rely on Black Duck audits to help them understand open source license c… Continue reading Next-generation audit reports: Enhanced visibility into open source risks in M&A transactions
The U.S. House Committee on Oversight and Government Reform has more than a few things to say about responsible enterprise application security. On Dec. 10, 2018, the House Oversight and Government Reform Committee released a staff report detailing the… Continue reading Security lessons from the House Oversight and Government Reform Committee
The EventStream incident shows just how easily attackers can infiltrate the open source software supply chain by adding a malicious dependency to a trusted component. What happened with EventStream? On Nov. 20, 2018, it was discovered that EventStream,… Continue reading NPM dependencies, supply chain attacks, and Bitcoin wallets
Many contracts contain language saying that if the licensee breaches/violates the license, the licensee will have an opportunity to cure that breach. But the GPLv2 provides no right to cure. Many contracts, either in their boilerplate form or as part o… Continue reading GPLv2 and the right to cure
Today’s software contains on average more than 50% open source. That’s why organizations with foresight are including software composition analysis in their security plans. FLIGHT East 2018 was full of tips, techniques, applications, and so… Continue reading Black Duck by Synopsys FLIGHT East 2018 presentations
In most transactions involving software assets, acquirers are asking the open source question, and software due diligence audits are quickly becoming the norm. The Black Duck by Synopsys On-Demand audit business sees substantial growth from year to yea… Continue reading Webinar: Black Duck Legal Certification Course
In April, Synopsys and GitHub spoke about adding “Sec” to DevOps by using solutions that don’t sacrifice speed or agility. Most of the discussion focused on software composition analysis for applications. But DevOps organizations are … Continue reading Webinar: Secure your containers with GitHub and Synopsys
Most companies involved with technology M&A understand the importance of open source risks in software. Today’s software contains significant amounts of open source, on average more than 50%, according to a 2018 Synopsys study. Consequently, … Continue reading Why you need to perform open source due diligence in an M&A transaction
The use of open source has surpassed the occasional and solidified itself as the standard. In fact, the Black Duck by Synopsys 2018 Open Source Security and Risk Analysis found that 96% of the applications we scanned last year contained open source com… Continue reading Webinar: Effective policies for managing and releasing open source software