Name: Understanding Container Security: Common Misconfigurations
Start: 2025-03-06T10:00:00Z
End: 2025-03-06T10:00:33.000Z
Location: BrightTALK
Rating: 0

Black Duck® offers the most comprehensive, powerful, and trusted portfolio of application security solutions in the industry. We have an unmatched track record of helping organizations around the world secure their software quickly, integrate security efficiently in their development environments, and safely innovate with new technologies. As the recognized leaders, experts, and innovators in software security, Black Duck has everything you need to build trust in your software.

As of October 1, 2024 the Synopsys Software Integrity Group is now Black Duck®

Leverage the power of policies to flag non-compliant components. With Black Duck SCA policies, create your own rules to determine 'non-compliance'. Join us in this webinar as we explore what policies are, how to configure them and how we can use them within our Black Duck SCA scans.

Black Duck SCA - Policy Management

Just as most software assets contain open source, modern software applications commonly include third party software functionality via calls to external web services via APIs. By using web services, developers may be inadvertently signing their companies up to terms of service or using a web service without a suitable agreement. Using these services can expose a company to compliance, security, data privacy, and operational risks that could disrupt or severely affect the business. As part of the tech M&A due diligence process, you should be aware of these web services-related risks so that you can make informed decisions about deal valuation and remediation.
 
Join us for a discussion about web services and how they can affect M&A and other transactions. We’ll cover:
 
• The legal compliance, data privacy, security, and business risks that come with web services
• Typical terms of service and common pitfalls
• Real-world examples of these risks
• How a buyer can get a better understanding of these risks in a target’s codebase or how a seller can prepare for diligence to avoid risks
 
Don’t miss this informative webinar. Register today.

Web Services & APIs: Impact on M&A and Other Transactions

Software is essential in everyday products like cars, medical devices, airplanes, and IoT devices. Bugs and security flaws can have serious impacts on safety, the environment, and your reputation. As AI speeds up software development, it's more important than ever to keep your policies, coding standards, and testing up to date.

In this webinar, we’ll discuss:
- Trends that offer innovation but also increase the risk of costly errors
- Updates to functional safety standards that improve software reliability
- How to reduce supply chain risks by getting a full view of your software
- Strengthening software with thorough testing techniques

Register now to learn practical tips for creating secure, reliable functional safety software in 2025 and beyond.

Building Safe and Reliable Software in 2025

Securing your software supply chain begins with knowing what’s in your code. With AI-generated code and ubiquitous open source software use, it’s never been more critical to understand what risks your software may contain. In fact, last year alone we found that 81% of codebases contained a high-/critical risk vulnerability.
 
Join this webinar as we explore the findings from the 2025 “Open Source Security and Risk Analysis” report. We’ll cover:
 
• The state of open source software security
• Tips for mitigating risks and keeping vulnerabilities out of your supply chain
• How to protect against security and IP risks from AI coding tools

The 2025 Guide to Open Source Security and Risk

Software due diligence is critical to understanding the risks in the software you’re acquiring, and planning for post-close. What’s in the code, including open source risks, security vulnerabilities, and software quality, as well as the process by which it was developed, matters with integration planning. With fast-moving deals and tight due diligence timelines, how does your due diligence playbook stack up?  

Join this fireside chat-style webinar for a discussion about the importance of software due diligence and best practices for mitigating risk in M&A. We’ll cover:  

• How audits can surface risk and what that means for a deal
• Why software due diligence is more than just an open source audit
• Implications of generative AI in software development
• Planning for success

Register today.

Software Due Diligence Best Practices: Ensuring Positive Outcomes in Tech M&A

Discover how Code Sight, an innovative IDE integration by Black Duck Software, empowers developers to write secure code with confidence. Join us to learn how this powerful tool performs local SAST and SCA analysis directly in your development environment, enabling your engineering team to shift left in the software development lifecycle. By identifying vulnerabilities early, Code Sight provides developers with actionable insights before code is checked in, reducing rework, and improving overall security.

Build Secure Code Faster: Real-Time Vulnerability Scanning with Code Sight

As software applications grow more complex, so do the security challenges they face. This webinar dives into the critical importance of proper software vulnerability detection, highlighting how current public vulnerability reporting systems often fall short. We’ll explore why accuracy and timeliness in identifying and addressing security risks are non-negotiable and demonstrate how free or entry-level tools fail to meet the demands of modern application security.
 
Join us and discover strategies and solutions that go beyond basic approaches, ensuring your applications remain resilient in an ever-changing threat environment. This session will equip you with the knowledge and tools to elevate your security practices and protect what matters most.
 
Key takeaways:
- Why vulnerability detection is foundational to application security
- The pitfalls of public vulnerability reporting and how to navigate them
- The importance of accurate, timely responses to emerging threats
- Why free tools aren’t enough—and what to look for in advanced security solutions

Your AppSec Assessments Are Wrong, And Why It Matters

The Common Vulnerabilities and Exposures (CVE) system allows interested parties to track all the relevant information about a specific vulnerability. It helps avoid duplication and allows software vendors and users alike to ensure that they are referring to the same vulnerability in their efforts to protect systems against attack. 

In this 15 minute session, you’ll gain
• An understanding of what the CVE system is
• Knowledge of the stakeholders involved 
• Insight into the elements of a CVE ID
• A walkthrough of the CVE Record Lifecycle

CVE Explained

The world of application security can be overwhelming for newcomers. The technical jargon, complex solutions, and confusing methodologies make it hard to navigate. It’s essential to understand threat modeling and threat and risk analysis, but that can be difficult without the right guidance.

Here’s the good news: threat modeling at its core is intuitive and adaptable. With the right approach, it can be a powerful tool that helps you understand risks and make informed security decisions while aligning with your organization's unique needs.

In this webinar, we’ll break down the complexity of threat modeling. We'll address common questions and show why it’s a central part of application security. Participants will leave with a clear understanding of
• What threat modeling is and why it matters
• How to tailor threat modeling to fit your organization and industry
• Where to find resources for further learning and practical implementation

Threat Modeling: Charting Your Security Journey

Kubernetes is known for its ability to scale quickly, but does its security and management keep up with that growth? As your Kubernetes setup expands, it becomes harder to spot and fix potential problems.

Join our experts as they share modern ways to manage Kubernetes clusters and explain how to find misconfigurations and reduce risks.

In this discussion, you'll learn:
- A new way to look at and manage your Kubernetes clusters.
- How to spot dangerous misconfigurations and improve your cluster's security.

Don't miss out on learning how to secure your Kubernetes setup as it grows.

Securing Kubernetes Clusters: Managing Security and Risk

In February 2024, the NIST Cybersecurity Framework (CSF) 2.0 update was released, featuring the latest advancements. This update brings a host of transformative changes, expanding the framework's scope. It also provides stronger governance and supply chain risk management. There are also refining metrics for assessing cybersecurity effectiveness. 

Join this webinar to learn about
• The long-anticipated CSF 2.0 update
• The implications of the changes in the 2.0 update 
• Leveraging these changes to improve current cybersecurity programs

Embracing the Future of Cybersecurity with NIST CSF 2.0

Gone are the days when you only had to worry about the code your developers are writing. Now you have to think about a complex supply chain, which includes everything from open source dependencies and APIs to containers, infrastructure-as-code, and CI/CD toolchains. Recent supply chain attacks, along with the U.S. executive order on cybersecurity, have organizations re-evaluating the security of their software supply chains. 

In this webinar, our expert panelists will discuss 
• Why securing your supply chain means more than having an accurate software Bill of Materials (SBOM)
• What the executive order and other initiatives mean for software producers and consumers
• What security and development teams need to do to manage new and evolving supply chain threats

Learn what you can do to enhance the security of your software supply chain. Register now.

Securing the Software Supply Chain: More Than Just an SBOM?

Containerized applications and microservices simplify scaling and deployment. Yet, they also create new opportunities for attackers to exploit. Misconfigurations in these environments can allow attackers to hide, move, and launch advanced attacks.
 
Join us for a deep dive into common container misconfigurations. We'll dive into Black Duck’s extensive experience in container penetration testing.
 
What you’ll learn:
    •    Common misconfigurations found in containerized environments.
    •    How attackers exploit these vulnerabilities to compromise systems.
    •    Strategies to reduce risks and enhance container security.

Understanding Container Security: Common Misconfigurations

APIs have become central to the daily operations of most businesses. Their rapid proliferation has exposed significant vulnerabilities that need immediate attention. This presentation provides an in-depth assessment of the current state of API security. We discuss the growth of API-related incidents and provide a framework for improving API security within organizations.

Join this webinar to learn about
• API security challenges due to the increase in API usage, and the resulting vulnerabilities
• Proactive security integrations for incorporating security measures throughout the entire API development life cycle
• A framework for enhancing API security to protect against emerging threats

Elevating API Security

Security remains a leading concern for businesses in this multi-cloud era. With the increasing cloud-native deployment and use of generative AI in application software development, along with proliferation of tools, data and applications distributed across various cloud platforms, ensuring a consistent and robust security posture and at the same time, keep pace with the fast DevOps CI/CD pipeline can be daunting.

The  webinar will explore some of the challenges organizations face when navigating the complex landscape in securing their applications from code to cloud in a fast-paced DevOps CI/CD environment. Attendees will gain insights into how companies overcome these challenges and implement robust and effective application security solutions that align to their DevSecOps initiatives.

Key Takeaways: 

- Recognize the security challenges in this high pace, evolving technology landscape
- The importance of adopting an integrated “Essential Three” app security strategy
- Practical solutions for DevSecOps alignment from a customer perspective

Cloud-native and Generative AI Implications in DevSecOps

Securing software takes teamwork—a unified approach from development through testing and into production. But each team has a distinct set of requirements and workflows that need to align to realize a concerted push for security. And while developers influence risk posture, they are often not trained in or focused on software security practices.

How can you make the effort that developers and DevOps teams are already putting in more valuable to the business? What's the best way to cultivate highly security-conscious developers so your software becomes more secure over time? Is there a way to derive tangible benefits for the business, the team, and the individual?

Join us as we break down a five-step process with real-world applicability. Topics include

• The critical distinction between developers' security awareness and their security capability
• Mechanisms to automate risk detection and accelerate remediation across the pipeline, including at the developer desktop
• How to establish security gates in DevOps pipelines in a way that doesn't derail development or lead to missed shipping deadlines
• How to create a DevSecOps initiative that can evolve with the business and enable developers to sustain security requirements as part of their day-to-day
• Ways to maximize security's value to the business and its customers

5 Steps to Achieving Developer-First Security

Python is a fast, platform-agnostic, and easy-to-learn programming language that is suited for beginners and experienced developers alike. Ever since its first release in 1991, Python has had a constant presence in the computer world and has become a go-to language thanks to its easy-to-understand code and versatility. Today, Python can boast a wide array of libraries and frameworks, and they are the cornerstone of fast and easy Python programming—the so-called Pythonic way of development.
 
But like all programming languages, Python is not immune to security threats. Secure coding best practices must be adopted to avoid risks from attackers. In this webinar, we’ll explore Python security best practices that should employed when building secure application.

Python 101

Forcing AppSec tests into developer pipelines, without aligning them to their preferred tools, can lead to inefficiencies and security oversights. Security teams need full risk visibility and developers need to meet shipping deadlines. While developers should not take full responsibility for security testing, they must be able to initiate, support, and benefit from it without changing their existing workflows. 

The most effective and efficient way to accomplish this is with out-of-the-box integrations and security testing templates that work natively with leading DevOps platforms like GitHub, GitLab, and Azure DevOps (ADO) to automate critical AppSec tests and quickly close feedback loops with developers. Join Black Duck as we discuss: 

Using DevOps platforms’ automation templates to embed AppSec into CI pipelines 

- Making security scans and fix pull requests an automatic part of dev workflows 
- Reducing risk and issue backlogs with developer security training and clear fix guidance 
- Accelerating AppSec using AI-enabled DevOps and security tools 

Start making life easier for developers and AppSec teams with integrated security testing for GitHub, GitLab, ADO, and more.

Developer-First Security: How to Automate Security Tests with GitHub, GitLab, and more

Containerization

Containers

Penetration Testing

Attack Surface

Attack Surface Management

Attack Vectors

Risk Analysis

Risk Based Security

Risk Assessment

Risk Framework

Intellectual property law is crucial to ensuring that you or your organization have exclusive rights to that assets that you’ve created. The BrightTALK intellectual property community has thousands of professionals focused on learning and exchanging information about intellectual property management, intellectual property software and how to protect intellectual property. Join the community for access to free, interactive presentations or attend live webinars to have your questions answered by IP lawyers and industry experts.

Intellectual Property

The legal community on BrightTALK combines the fields of employment law, e-discovery, intellectual property and environmental law to create a thriving ecosystem of legal resources. Attend live and on-demand webinars dealing with employment contract law, e-discovery solutions, intellectual property software and sustainable development from leading lawyers and legal professionals to gain knowledge in a wide range of fields. Join the community and be part of the conversation by attending live legal webinars and connecting with industry thought leaders.

Legal

The IT security community on BrightTALK is composed of more than 200,000 IT security professionals trading relevant information on software assurance, network security and mobile security. Join the conversation by watching on-demand and live information security webinars and asking questions of experts and industry leaders.

IT Security

Increasing expectations for good governance, effective risk management and complex demands for corporate compliance are presenting a growing challenge for organizations of all sizes. Join industry thought leaders as they provide you with practical advice on how to implement successful risk and compliance management strategies across your organization. Browse risk management resources in the form of interactive webinars and videos and ask questions of expert GRC professionals.

IT Governance, Risk and Compliance

The application development community features top thought leadership focusing on optimal practices in software development, SDLC methodology, mobile app development and application development platforms and tools. Join top software engineers and coders as they cover emerging trends in everything from enterprise app development to developing for mobile platforms such as Android and iOS.

Application Development

Enterprise applications have become a crucial piece of infrastructure for many businesses. The enterprise applications community on BrightTALK features the latest insights in enterprise application integration, enterprise application architecture and EAS software. Join the community to gain access to thousands of videos and webinars presented by recognized enterprise information systems experts and arm yourself with the knowledge you need to succeed.

Enterprise Applications

Join thousands of engaged IT professionals in the application management community on BrightTALK. Interact with your peers in relevant webinars and videos on the latest trends and best practices for application lifecycle management, application performance management and application development.

Application Management

As an IT professional, many of the problems you face are multifaceted, complex and don’t lend themselves to simple solutions. The information technology community features useful and free information technology resources. Join to browse thousands of videos and webinars on ITIL best practices, IT security strategy and more presented by leading CTOs, CIOs and other technology experts.

Information Technology

Internal audit and compliance professionals are facing increasingly stringent regulatory requirements when it comes to compliance reporting and internal control procedures. Join the audit and compliance community to learn best practices from thought leaders on topics such as regulatory compliance, internal audit checklists and audit program strategies.

Audit and Compliance

Get powerful market trends insights that are shaping the M

Mergers and Acquisitions

The accounting and finance community on BrightTALK features presentations from leading accountants and finance professionals. The accounting community includes tax planning strategies, QuickBooks webinars and other accounting webinars, while the finance community features presentations on financial capital regulations and forensic data analytics. Join the conversation by attending live financial and accounting presentations and connecting with industry thought leaders.

Understanding Container Security: Common Misconfigurations

Presented by

About this talk

More from this channel