Name: 5 Steps to Integrate SAST into the DevSecOps Pipeline
Start: 2023-06-08T09:00:00Z
End: 2023-06-08T09:01:00.000Z
Location: BrightTALK
Rating: 5

Black Duck® offers the most comprehensive, powerful, and trusted portfolio of application security solutions in the industry. We have an unmatched track record of helping organizations around the world secure their software quickly, integrate security efficiently in their development environments, and safely innovate with new technologies. As the recognized leaders, experts, and innovators in software security, Black Duck has everything you need to build trust in your software.

As of October 1, 2024 the Synopsys Software Integrity Group is now Black Duck®

Gain insights into important legal developments from two of the leading open source legal experts, Tony Decicco, Principal at GTC Law Group & Affiliates and Chris Stevenson, Of Counsel at DLA Piper.

This annual review will highlight the most significant legal developments related to open source software in 2024, focusing on topics that were resolved, those that got started and what we can expect to see in coming years.

The 2024 Open Source Year in Review

Just as most software assets contain open source, modern software applications commonly include third party software functionality via calls to external web services via APIs. By using web services, developers may be inadvertently signing their companies up to terms of service or using a web service without a suitable agreement. Using these services can expose a company to compliance, security, data privacy, and operational risks that could disrupt or severely affect the business. As part of the tech M&A due diligence process, you should be aware of these web services-related risks so that you can make informed decisions about deal valuation and remediation.
 
Join us for a discussion about web services and how they can affect M&A and other transactions. We’ll cover:
 
• The legal compliance, data privacy, security, and business risks that come with web services
• Typical terms of service and common pitfalls
• Real-world examples of these risks
• How a buyer can get a better understanding of these risks in a target’s codebase or how a seller can prepare for diligence to avoid risks
 
Don’t miss this informative webinar. Register today.

Web Services & APIs: Impact on M&A and Other Transactions

Legislation requiring stringent software security practices by software producers is being passed around the globe. This requires organizations to rethink their approach to software security, which industry standards they follow, and the best practices for their software development teams.

NIST has produced guidance known as the Secure Software Development Framework (SSDF). The SSDF is a series of practices and associated tasks that serve as a baseline for teams seeking to securely develop software in a standardized way. Attestation to conformance with a subset of the SSDF has been signaled by the U.S.

In this webinar, you will learn the best practices for performing an SSDF readiness assessment including:

• Whether your organization’s software development practices align with the SSDF
• How to determine which controls are lacking for conformance with guidelines
• How to perform associated corrective recommendations on time
• Case studies of successful U.S. government attestations

Best Practices for Leveraging the SSDF

Technology drives business value and understanding the intricacies of software due diligence has become paramount in M&A. While mitigating risk has always been the priority, the risk landscape has changed over time, the risk categories have expanded, and the diligence process has evolved. 
 
Join us for this webinar to learn how the software risk landscape has evolved and how Black Duck has evolved along with it. We’ll cover:

• Key software trends over time and implications for software due diligence
• Types of software risks and how to mitigate them 
• How Black Duck’s audit offerings have evolved to address software risk

Register today.

The Evolution of Software Due Diligence in M&A

The Common Vulnerabilities and Exposures (CVE) system allows interested parties to track all the relevant information about a specific vulnerability. It helps avoid duplication and allows software vendors and users alike to ensure that they are referring to the same vulnerability in their efforts to protect systems against attack. 

In this 15 minute session, you’ll gain
• An understanding of what the CVE system is
• Knowledge of the stakeholders involved 
• Insight into the elements of a CVE ID
• A walkthrough of the CVE Record Lifecycle

As of October 1, 2024 the Synopsys Software Integrity Group is now Black Duck®

CVE Explained

Generative artificial intelligence (GAI) will fundamentally change the way that software is built. Whether they are developing or using AI tools, organizations must understand the opportunities and risks involved, and evolve governance, policies and processes to address those risks.

Join this webinar for a deep dive into the issues that arise when using GAI in software development. We’ll cover:

• Open source data and software licenses and risks with AI
• Licensing and clearance considerations for materials used to train AI models
• Licensing considerations in building, training, and using AI models
• A deep dive on GitHub Copilot, including implications of the class action suit

Generative AI, Training Data, Open Source, and GitHub Copilot, Oh My!

APIs have become central to the daily operations of most businesses. Their rapid proliferation has exposed significant vulnerabilities that need immediate attention. This presentation provides an in-depth assessment of the current state of API security. We discuss the growth of API-related incidents and provide a framework for improving API security within organizations.

Join this webinar to learn about
• API security challenges due to the increase in API usage, and the resulting vulnerabilities
• Proactive security integrations for incorporating security measures throughout the entire API development life cycle
• A framework for enhancing API security to protect against emerging threats

Elevating API Security: A Structured Approach

As with all things tech, software development has been in a constant state of evolution since its infancy. Generative AI, however, has the potential to disrupt software development as we know it.
There are significant benefits offered by generative AI, but there are risks as well, including security risks. In its brief history, AI has generated buggy code, taken code from open source repositories without licensing considerations, and generated incorrect code.
In this webinar, you will learn
• What AI is and how it is used in the SDLC
• The ways AI is changing how software is being built
• The risks, drawbacks, and concerns of using AI
• How to benefit from AI while managing risks

How Generative AI is Changing the SDLC

This year’s DevSecOps report defines a vivid image of organizations’ journey to secure their software development pipelines. It provides intriguing conclusions about operational challenges, AppSec efficiency, and evolving risk exposure amid the rise of AI-assisted development. Did you know that although 85% of respondents have some measures in place to address the challenges posed by AI-generated code, only 24% are “very confident” in their policies and processes for testing such code? 

Join us as we examine the key findings from the Black Duck 2024 DevSecOps report and discuss

• The state of DevSecOps across roles and technologies in light of AI-assisted development
• What a maturing DevSecOps program looks like, and which tools and practices foster growth
• How to integrate application security without impeding DevOps

DevSecOps in the Wild: Examining Global Security Factors in 2024

Do you want to secure your software at scale? An application security posture management (ASPM) solution could be the answer. Maintain a strong security posture —and ensure compliance with industry standards and regulations—by gaining visibility into your applications.

Join us for a panel discussion where we share steps for securing applications. You'll learn

• Real-world use cases: Discover how regulatory-heavy industries and large enterprises use ASPM to address security challenges

• Operationalizing testing: Gain insights into how security teams can use ASPM to automate and operationalize security testing

• Maturing your AppSec program: Learn practical steps to enhance your AppSec program with ASPM

Don't miss the opportunity to learn how to be proactive in risk management.

Secure Application Software at Scale

掌握软件安全，领先一步。Black Duck Software Risk Manager 平台（SRM） 是业界领先的应用程序安全态势管理 (ASPM)解决方案，专为现代软件开发团队设计，可帮助安全及开发团队管理其应用程序的安全风险。SRM通过统一策略、测试编排、智能去重、关联分析、优先级排序等一站式功能，大幅简化整个企业的应用安全管理活动。SRM在接入业界130多种AST工具的同时，还内置了SAST （Coverity）和SCA（BlackDuck）引擎，保护客户既有投资的基础上，助力企业快速同步业界最佳AST能力。此外，SRM还能便捷集成到研发pipeline，实现向客户现有流程的轻松融入。

AIGC时代的智能化软件风险管理 —— Black Duck SRM平台，统一管控和消除软件安全风险

Understanding the risks associated with open source software has become the norm in tech due diligence, but not all approaches are created equal. Knowing what’s in the software you’re acquiring is the first step. Few targets are able to produce an SBOM and when they do, it tends to be about 50% accurate. Is “good enough” good enough for M&A?

Join this live Synopsys webinar to learn how a purpose-built M&A open source audit differs from open source management tools and why it matters in tech due diligence. We’ll cover:

• The risks associated with open source software 
•Why depth of analysis matters, and what it results in during M&A diligence
•Why accuracy, reporting and expert human analysis are keys to thorough diligence

Don’t miss this informative webinar. Register today.

Open Source Software Audit vs Scan: What’s Right for M&A?

There is no shortage of buzz around generative artificial intelligence (GAI). GAI can be used in software development to generate and augment code which saves times and reduces development cycles. But using AI in software development comes with its own set of risks.

Join this webinar to get an introduction to GAI and how you can minimize risk when using it in your organization. We’ll cover:

• What GAI is and how machines learn
• Legal issues with AI including copyright, web scraping, and more
• Overview of current litigation
• Practical approaches to using GAI while minimizing risk

Best Practices for Using AI in Software Development

In February 2024, the NIST Cybersecurity Framework (CSF) 2.0 update was released, featuring the latest advancements. This update brings a host of transformative changes, expanding the framework's scope. It also provides stronger governance and supply chain risk management. There are also refining metrics for assessing cybersecurity effectiveness.

Join this webinar to learn about
• The long-anticipated CSF 2.0 update
• The implications of the changes in the 2.0 update
• Leveraging these changes to improve current cybersecurity programs

Embracing the Future of Cybersecurity with NIST CSF 2.0

Join us for a webinar discussing the challenges organizations face in transitioning to PCI-DSS 4.0 and implementing new security measures. We will explore the updates to the security framework and the critical need to secure APIs to protect sensitive payment information. Don't miss this opportunity to learn about the latest in PCI-DSS 4.0 and how to effectively adapt to these new standards.

PCI-DSS 4.0 Explained: Enhancements, Challenges, and APIs

Interested in the latest trends in application security? Find our what you've missed in September and listen to our recap.

AppSec Highlights September

The Board and C-Suite are starting to take notice of the opportunities and risks inherent with powerful new generative artificial intelligence (GAI) tools that can quickly create text, code, images, and other media. Product Development and Engineering teams want to use such tools to increase productivity by at least one order of magnitude. In response, the Security, Legal, and Compliance teams typically raise legitimate concerns about the risks involved. What role can the Board and C-Suite play in this situation?
 
Join this live Synopsys webinar to get a jump start on what AI strategy, security, and governance looks like from the Board-level and C-suite. We’ll cover:
 
• Fundamentals of AI, types of models, and data used to inform them
• Expanding existing processes and procedures to address the security risks of GAI
• The top three questions the Board and C-Suite should be asking about GAI
• How to navigate the existing and evolving legal and regulatory landscape

AI Strategy, Security, and Governance: The View from the Top

With the cost of cyberattacks predicted to cost $10.5 trillion by 2025, the European Commission is looking to transform the cybersecurity landscape through the Cyber Resilience Act. The goal of the CRA is to “bolster cybersecurity rules to ensure more secure hardware and software products.” But what does that mean for those of us already involved in AppSec?

Join our experts as they discuss how AppSec professionals may be impacted by CRA as it exists today. Specifically, we’ll explore: 
- Which products may be subject to the CRA based on the definition of “digital elements”
- What impacts this could have on software supply chain moving forward
- How you can assess your AppSec programs to see where you stand with CRA as defined today

The CRA is currently a draft, as such opinions and insights from presenters are subject to change.

What the EU Cyber Resilience Act Means for AppSec

What the CRA means to DevSecOps Teams

It’s Time for AppSec to Evolve

DevSecOps in the Wild: Examining Global Security Factors in 2023

The Future of Automation AppSec with Polaris Assist powered by AI

AppSec Automation: Five Steps to Achieving Developer-First Security

Dynamic Analysis for Modern Day DevOps

Security at Every Stage: Integrating AppSec for Efficient DevSecOps

A Modern Approach to Application Security

Transforming DevSecOps in Turbulent Times

Achieving DevSecOps: Ways to reduce AppSec noise at scale

Coffee with a Side of DevSecOps

Top Challenges With Shifting Security to Development

Enable your DevSecOps Initiative with Security Champions

DevSecOps Explained

Cracking the Code of DevSecOps

Where Will DevSecOps 'Shift' Next?

Building Security into DevOps

Even software with a solid architecture and design can harbor vulnerabilities, whether due to mistakes or shortcuts. But limited security staff don’t have the resources to perform code reviews and provide remediation guidance on the entire application portfolio. Static analysis, also known as static application security testing (SAST), is an automated way to find bugs, back doors, and other code-based vulnerabilities so the team can mitigate those risks.

First, though, you must choose a static analysis model that fits your needs. You might have questions such as these:
- How do I manage false positives?
- How do I triage the results?
- What happens to new issues identified?
- My scan takes hours to complete. How can I use this tool in my DevSecOps pipeline?
- What is a “baseline scan”?

Join us as we walk you through the challenges and benefits of integrating a SAST tool into your DevSecOps pipeline and how we’ve helped other organizations with this process.

5 Steps to Integrate SAST into the DevSecOps Pipeline

DevSecOps

SAST

static analysis

Architecture

Application Development

Application Security

Application Monitoring

Security Testing

DevOps

IT Security

Intellectual property law is crucial to ensuring that you or your organization have exclusive rights to that assets that you’ve created. The BrightTALK intellectual property community has thousands of professionals focused on learning and exchanging information about intellectual property management, intellectual property software and how to protect intellectual property. Join the community for access to free, interactive presentations or attend live webinars to have your questions answered by IP lawyers and industry experts.

Intellectual Property

The legal community on BrightTALK combines the fields of employment law, e-discovery, intellectual property and environmental law to create a thriving ecosystem of legal resources. Attend live and on-demand webinars dealing with employment contract law, e-discovery solutions, intellectual property software and sustainable development from leading lawyers and legal professionals to gain knowledge in a wide range of fields. Join the community and be part of the conversation by attending live legal webinars and connecting with industry thought leaders.

Legal

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

The application development community features top thought leadership focusing on optimal practices in software development, SDLC methodology, mobile app development and application development platforms and tools. Join top software engineers and coders as they cover emerging trends in everything from enterprise app development to developing for mobile platforms such as Android and iOS.

Enterprise applications have become a crucial piece of infrastructure for many businesses. The enterprise applications community on BrightTALK features the latest insights in enterprise application integration, enterprise application architecture and EAS software. Join the community to gain access to thousands of videos and webinars presented by recognized enterprise information systems experts and arm yourself with the knowledge you need to succeed.

Enterprise Applications

Join thousands of engaged IT professionals in the application management community on BrightTALK. Interact with your peers in relevant webinars and videos on the latest trends and best practices for application lifecycle management, application performance management and application development.

Application Management

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Information Technology

Internal audit and compliance professionals are facing increasingly stringent regulatory requirements when it comes to compliance reporting and internal control procedures. Join the audit and compliance community to learn best practices from thought leaders on topics such as regulatory compliance, internal audit checklists and audit program strategies.

Audit and Compliance

Get powerful market trends insights that are shaping the M

Mergers and Acquisitions

The accounting and finance community on BrightTALK features presentations from leading accountants and finance professionals. The accounting community includes tax planning strategies, QuickBooks webinars and other accounting webinars, while the finance community features presentations on financial capital regulations and forensic data analytics. Join the conversation by attending live financial and accounting presentations and connecting with industry thought leaders.

5 Steps to Integrate SAST into the DevSecOps Pipeline

Presented by

About this talk

More from this channel