SlideShare a Scribd company logo

Managing the Security Impact of Bundled Open Source Software from OSCON

•
•
Cisco Security
Cisco Security

The benefits of including Open Source Software in products and services are very well understood, including many that greatly improve the security of the resultant product. Less well-known or understood, however, is the real security impact of bundling OSS and other third-party software into products. View the blog and on-demand presentation: http://ow.ly/dIZsl

Technology
1 of 25
Managing the Security Impact of Bundled Third-Party Software Tim Sammut tsammut@cisco.com
About me Cisco Security Research & Gentoo Linux Security Team ICASI Third-Party Software Operations Member Security Working Group Chair tsammut@cisco.com underling@gentoo.org
About you
Do you produce a product, service or package?
Do you disclose vulnerabilities to your customers?
Where is third-party software creating security problems for you?
 Open Source Software vs. Third-Party Software Quick Level Set  Do we even care about this stuff?  What are we trying to accomplish?
It is not our code, but it is our product!
The Challenges
 Which packages?  Which versions?  Which compile-time options? Knowing Where  Which kernel versions? TPS is Used Given a vulnerable TPS package can you reliably determine affected products? Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
 Exposure expands in under-understood ways  Dependencies are equally exposed to vulnerabilities Understanding  Tools hide build and run-time dependencies Dependencies Focus is often on point requirements without documenting every TPS package incorporated. Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
 No naming scheme  Even authoritative names change  Locally modified packages are indistinguishable Inconsistent  Simple input variances Package Naming  Versioning is itself complex Are you able to efficiently process large amounts of TPS usage data? Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
 How are development teams choosing which TPS is used?  Are the considering stability or security? Unmanageable  Are they planing for the ongoing maintenance? Selection Processes Are you gaining development-time freedoms at the expense of long-term maintainability? Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
 No “Single Source of Truth” Learning of Newly  Disclosure formats, vehicles and time lines vary wildly Disclosed  Monitoring the CVE dictionary is incomplete Vulnerabilities Do you learn of new and relevant TPS vulnerabilities before your customers? Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
 Do we wait for a new upstream release?  Do we upgrade? Can we upgrade?  Do we patch? Inconsistent Fixing  Will an upstream fix ever come? of Vulnerabilities  Is the upstream even active? Solving this one time is easy. Do you know what you did last time or across many products? Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
 Who is responsible to fix the issue? External  How quickly?  In what cases? Development  And for how long? Partners  Are each of the previous challenges covered? Combining TPS and external partners creates efficiency and vast unknowns that must be managed. Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
What other challenges exist? Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
The “Solutions”
Absolutely critical and foundational to success Build a Strong Catalog of TPS Use Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
Creates tremendous efficiencies throughout the problem space Standardize Everything Possible Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
Must produce a consistent vulnerability feed for internal consumption Monitor Vulnerability Disclosure Scalably Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
Key to understanding today's impact and the historic record Instrument the Bug Database Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
Support and require the equivalent of internal processes Require Contract Language with Partners Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
Questions? It is not our code, but it is our product!
Thank you. tsammut@cisco.com

Recommended

2013 Cisco Annual Security Report
2013 Cisco Annual Security Report2013 Cisco Annual Security Report
2013 Cisco Annual Security ReportCisco Security
 
Enterprise Strategy Group: Security Survey
Enterprise Strategy Group: Security SurveyEnterprise Strategy Group: Security Survey
Enterprise Strategy Group: Security SurveyCisco Security
 
Cisco 2015 Midyear Security Report Slide Deck
Cisco 2015 Midyear Security Report Slide DeckCisco 2015 Midyear Security Report Slide Deck
Cisco 2015 Midyear Security Report Slide DeckCisco Security
 
Defending the Data Center: Managing Users from the Edge to the Application
Defending the Data Center: Managing Users from the Edge to the ApplicationDefending the Data Center: Managing Users from the Edge to the Application
Defending the Data Center: Managing Users from the Edge to the ApplicationCisco Security
 
Infographic: Security for Mobile Service Providers
Infographic: Security for Mobile Service ProvidersInfographic: Security for Mobile Service Providers
Infographic: Security for Mobile Service ProvidersCisco Security
 
Data Center Security Now and into the Future
Data Center Security Now and into the FutureData Center Security Now and into the Future
Data Center Security Now and into the FutureCisco Security
 
From Physical to Virtual to Cloud
From Physical to Virtual to CloudFrom Physical to Virtual to Cloud
From Physical to Virtual to CloudCisco Security
 
Identify Zero-Day Breaches with Cognitive Threat Analytics on Cisco Web Secur...
Identify Zero-Day Breaches with Cognitive Threat Analytics on Cisco Web Secur...Identify Zero-Day Breaches with Cognitive Threat Analytics on Cisco Web Secur...
Identify Zero-Day Breaches with Cognitive Threat Analytics on Cisco Web Secur...Cisco Security
 

Recommended

2013 Cisco Annual Security Report
2013 Cisco Annual Security Report2013 Cisco Annual Security Report
2013 Cisco Annual Security ReportCisco Security
 
Enterprise Strategy Group: Security Survey
Enterprise Strategy Group: Security SurveyEnterprise Strategy Group: Security Survey
Enterprise Strategy Group: Security SurveyCisco Security
 
Cisco 2015 Midyear Security Report Slide Deck
Cisco 2015 Midyear Security Report Slide DeckCisco 2015 Midyear Security Report Slide Deck
Cisco 2015 Midyear Security Report Slide DeckCisco Security
 
Defending the Data Center: Managing Users from the Edge to the Application
Defending the Data Center: Managing Users from the Edge to the ApplicationDefending the Data Center: Managing Users from the Edge to the Application
Defending the Data Center: Managing Users from the Edge to the ApplicationCisco Security
 
Infographic: Security for Mobile Service Providers
Infographic: Security for Mobile Service ProvidersInfographic: Security for Mobile Service Providers
Infographic: Security for Mobile Service ProvidersCisco Security
 
Data Center Security Now and into the Future
Data Center Security Now and into the FutureData Center Security Now and into the Future
Data Center Security Now and into the FutureCisco Security
 
From Physical to Virtual to Cloud
From Physical to Virtual to CloudFrom Physical to Virtual to Cloud
From Physical to Virtual to CloudCisco Security
 
Identify Zero-Day Breaches with Cognitive Threat Analytics on Cisco Web Secur...
Identify Zero-Day Breaches with Cognitive Threat Analytics on Cisco Web Secur...Identify Zero-Day Breaches with Cognitive Threat Analytics on Cisco Web Secur...
Identify Zero-Day Breaches with Cognitive Threat Analytics on Cisco Web Secur...Cisco Security
 
Cisco ISE Reduces the Attack Surface by Controlling Access
Cisco ISE Reduces the Attack Surface by Controlling AccessCisco ISE Reduces the Attack Surface by Controlling Access
Cisco ISE Reduces the Attack Surface by Controlling AccessCisco Security
 
Cisco Web and Email Security Overview
Cisco Web and Email Security OverviewCisco Web and Email Security Overview
Cisco Web and Email Security OverviewCisco Security
 
Pervasive Security Across Your Extended Network
Pervasive Security Across Your Extended NetworkPervasive Security Across Your Extended Network
Pervasive Security Across Your Extended NetworkCisco Security
 
McAllen Intermediate School District
McAllen Intermediate School DistrictMcAllen Intermediate School District
McAllen Intermediate School DistrictCisco Security
 
Rizkan
RizkanRizkan
RizkanArya Ningrat
 
Taylor rita visual_resumestoryboard.zip
Taylor rita visual_resumestoryboard.zipTaylor rita visual_resumestoryboard.zip
Taylor rita visual_resumestoryboard.zipRita_E
 
Dapodik ltj
Dapodik ltjDapodik ltj
Dapodik ltjArya Ningrat
 
Intannnnn5555
Intannnnn5555Intannnnn5555
Intannnnn5555Arya Ningrat
 
Plasma e2 24-01-53
Plasma e2 24-01-53Plasma e2 24-01-53
Plasma e2 24-01-53Neannapa Khajornmot
 
Storyboard ikan anyaman kpd 3026
Storyboard ikan anyaman kpd 3026Storyboard ikan anyaman kpd 3026
Storyboard ikan anyaman kpd 3026Affizan Eady
 
Hipertensi 2
Hipertensi 2Hipertensi 2
Hipertensi 2Arya Ningrat
 
Workshop "Smart cities and communities" @ La Sapienza
Workshop "Smart cities and communities" @ La SapienzaWorkshop "Smart cities and communities" @ La Sapienza
Workshop "Smart cities and communities" @ La SapienzaSaverio Massaro
 
Incident Response Services Template - Cisco Security
Incident Response Services Template - Cisco SecurityIncident Response Services Template - Cisco Security
Incident Response Services Template - Cisco SecurityCisco Security
 
3 Tips for Choosing a Next Generation Firewall
3 Tips for Choosing a Next Generation Firewall3 Tips for Choosing a Next Generation Firewall
3 Tips for Choosing a Next Generation FirewallCisco Security
 
AMP Helps Cisco IT Catch 50% More Malware threats
AMP Helps Cisco IT Catch 50% More Malware threatsAMP Helps Cisco IT Catch 50% More Malware threats
AMP Helps Cisco IT Catch 50% More Malware threatsCisco Security
 
A Reality Check on the State of Cybersecurity
A Reality Check on the State of CybersecurityA Reality Check on the State of Cybersecurity
A Reality Check on the State of CybersecurityCisco Security
 
Balance Data Center Security and Performance
Balance Data Center Security and PerformanceBalance Data Center Security and Performance
Balance Data Center Security and PerformanceCisco Security
 
The Cost of Inactivity: Malware Infographic
The Cost of Inactivity: Malware InfographicThe Cost of Inactivity: Malware Infographic
The Cost of Inactivity: Malware InfographicCisco Security
 
Data Center Security Challenges
Data Center Security ChallengesData Center Security Challenges
Data Center Security ChallengesCisco Security
 
Malware and the Cost of Inactivity
Malware and the Cost of InactivityMalware and the Cost of Inactivity
Malware and the Cost of InactivityCisco Security
 
Midsize Business Solutions: Cybersecurity
Midsize Business Solutions: CybersecurityMidsize Business Solutions: Cybersecurity
Midsize Business Solutions: CybersecurityCisco Security
 
Integrated Network Security Strategies
Integrated Network Security StrategiesIntegrated Network Security Strategies
Integrated Network Security StrategiesCisco Security
 

More Related Content

Viewers also liked

Cisco ISE Reduces the Attack Surface by Controlling Access
Cisco ISE Reduces the Attack Surface by Controlling AccessCisco ISE Reduces the Attack Surface by Controlling Access
Cisco ISE Reduces the Attack Surface by Controlling AccessCisco Security
 
Cisco Web and Email Security Overview
Cisco Web and Email Security OverviewCisco Web and Email Security Overview
Cisco Web and Email Security OverviewCisco Security
 
Pervasive Security Across Your Extended Network
Pervasive Security Across Your Extended NetworkPervasive Security Across Your Extended Network
Pervasive Security Across Your Extended NetworkCisco Security
 
McAllen Intermediate School District
McAllen Intermediate School DistrictMcAllen Intermediate School District
McAllen Intermediate School DistrictCisco Security
 
Taylor rita visual_resumestoryboard.zip
Taylor rita visual_resumestoryboard.zipTaylor rita visual_resumestoryboard.zip
Taylor rita visual_resumestoryboard.zipRita_E
 
Storyboard ikan anyaman kpd 3026
Storyboard ikan anyaman kpd 3026Storyboard ikan anyaman kpd 3026
Storyboard ikan anyaman kpd 3026Affizan Eady
 
Workshop "Smart cities and communities" @ La Sapienza
Workshop "Smart cities and communities" @ La SapienzaWorkshop "Smart cities and communities" @ La Sapienza
Workshop "Smart cities and communities" @ La SapienzaSaverio Massaro
 

Viewers also liked (12)

Cisco ISE Reduces the Attack Surface by Controlling Access
Cisco ISE Reduces the Attack Surface by Controlling AccessCisco ISE Reduces the Attack Surface by Controlling Access
Cisco ISE Reduces the Attack Surface by Controlling Access
 
Cisco Web and Email Security Overview
Cisco Web and Email Security OverviewCisco Web and Email Security Overview
Cisco Web and Email Security Overview
 
Pervasive Security Across Your Extended Network
Pervasive Security Across Your Extended NetworkPervasive Security Across Your Extended Network
Pervasive Security Across Your Extended Network
 
McAllen Intermediate School District
McAllen Intermediate School DistrictMcAllen Intermediate School District
McAllen Intermediate School District
 
Rizkan
RizkanRizkan
Rizkan
 
Taylor rita visual_resumestoryboard.zip
Taylor rita visual_resumestoryboard.zipTaylor rita visual_resumestoryboard.zip
Taylor rita visual_resumestoryboard.zip
 
Dapodik ltj
Dapodik ltjDapodik ltj
Dapodik ltj
 
Intannnnn5555
Intannnnn5555Intannnnn5555
Intannnnn5555
 
Plasma e2 24-01-53
Plasma e2 24-01-53Plasma e2 24-01-53
Plasma e2 24-01-53
 
Storyboard ikan anyaman kpd 3026
Storyboard ikan anyaman kpd 3026Storyboard ikan anyaman kpd 3026
Storyboard ikan anyaman kpd 3026
 
Hipertensi 2
Hipertensi 2Hipertensi 2
Hipertensi 2
 
Workshop "Smart cities and communities" @ La Sapienza
Workshop "Smart cities and communities" @ La SapienzaWorkshop "Smart cities and communities" @ La Sapienza
Workshop "Smart cities and communities" @ La Sapienza
 

More from Cisco Security

Incident Response Services Template - Cisco Security
Incident Response Services Template - Cisco SecurityIncident Response Services Template - Cisco Security
Incident Response Services Template - Cisco SecurityCisco Security
 
3 Tips for Choosing a Next Generation Firewall
3 Tips for Choosing a Next Generation Firewall3 Tips for Choosing a Next Generation Firewall
3 Tips for Choosing a Next Generation FirewallCisco Security
 
AMP Helps Cisco IT Catch 50% More Malware threats
AMP Helps Cisco IT Catch 50% More Malware threatsAMP Helps Cisco IT Catch 50% More Malware threats
AMP Helps Cisco IT Catch 50% More Malware threatsCisco Security
 
A Reality Check on the State of Cybersecurity
A Reality Check on the State of CybersecurityA Reality Check on the State of Cybersecurity
A Reality Check on the State of CybersecurityCisco Security
 
Balance Data Center Security and Performance
Balance Data Center Security and PerformanceBalance Data Center Security and Performance
Balance Data Center Security and PerformanceCisco Security
 
The Cost of Inactivity: Malware Infographic
The Cost of Inactivity: Malware InfographicThe Cost of Inactivity: Malware Infographic
The Cost of Inactivity: Malware InfographicCisco Security
 
Data Center Security Challenges
Data Center Security ChallengesData Center Security Challenges
Data Center Security ChallengesCisco Security
 
Malware and the Cost of Inactivity
Malware and the Cost of InactivityMalware and the Cost of Inactivity
Malware and the Cost of InactivityCisco Security
 
Midsize Business Solutions: Cybersecurity
Midsize Business Solutions: CybersecurityMidsize Business Solutions: Cybersecurity
Midsize Business Solutions: CybersecurityCisco Security
 
Integrated Network Security Strategies
Integrated Network Security StrategiesIntegrated Network Security Strategies
Integrated Network Security StrategiesCisco Security
 
Cisco Addresses the Full Attack Continuum
Cisco Addresses the Full Attack ContinuumCisco Addresses the Full Attack Continuum
Cisco Addresses the Full Attack ContinuumCisco Security
 
Infonetics Network and Content Security Vendor Scorecard
Infonetics Network and Content Security Vendor ScorecardInfonetics Network and Content Security Vendor Scorecard
Infonetics Network and Content Security Vendor ScorecardCisco Security
 
Gartner Newsletter: Cisco TrustSec Deployed Across Enterprise Campus, Branch ...
Gartner Newsletter: Cisco TrustSec Deployed Across Enterprise Campus, Branch ...Gartner Newsletter: Cisco TrustSec Deployed Across Enterprise Campus, Branch ...
Gartner Newsletter: Cisco TrustSec Deployed Across Enterprise Campus, Branch ...Cisco Security
 
The Evolution of and Need for Secure Network Access
The Evolution of and Need for Secure Network AccessThe Evolution of and Need for Secure Network Access
The Evolution of and Need for Secure Network AccessCisco Security
 
Cisco 2014 Midyear Security Report
Cisco 2014 Midyear Security ReportCisco 2014 Midyear Security Report
Cisco 2014 Midyear Security ReportCisco Security
 
String of Paerls Infographic
String of Paerls InfographicString of Paerls Infographic
String of Paerls InfographicCisco Security
 
Midyear Security Report Infographic
Midyear Security Report InfographicMidyear Security Report Infographic
Midyear Security Report InfographicCisco Security
 
Cisco Annual Security Report Infographic
Cisco Annual Security Report InfographicCisco Annual Security Report Infographic
Cisco Annual Security Report InfographicCisco Security
 
City of Tomorrow Builds in Next-Generation Security
City of Tomorrow Builds in Next-Generation SecurityCity of Tomorrow Builds in Next-Generation Security
City of Tomorrow Builds in Next-Generation SecurityCisco Security
 
Laser Pioneer Secures Network End-to-End to Protect Assets
Laser Pioneer Secures Network End-to-End to Protect AssetsLaser Pioneer Secures Network End-to-End to Protect Assets
Laser Pioneer Secures Network End-to-End to Protect AssetsCisco Security
 

More from Cisco Security (20)

Incident Response Services Template - Cisco Security
Incident Response Services Template - Cisco SecurityIncident Response Services Template - Cisco Security
Incident Response Services Template - Cisco Security
 
3 Tips for Choosing a Next Generation Firewall
3 Tips for Choosing a Next Generation Firewall3 Tips for Choosing a Next Generation Firewall
3 Tips for Choosing a Next Generation Firewall
 
AMP Helps Cisco IT Catch 50% More Malware threats
AMP Helps Cisco IT Catch 50% More Malware threatsAMP Helps Cisco IT Catch 50% More Malware threats
AMP Helps Cisco IT Catch 50% More Malware threats
 
A Reality Check on the State of Cybersecurity
A Reality Check on the State of CybersecurityA Reality Check on the State of Cybersecurity
A Reality Check on the State of Cybersecurity
 
Balance Data Center Security and Performance
Balance Data Center Security and PerformanceBalance Data Center Security and Performance
Balance Data Center Security and Performance
 
The Cost of Inactivity: Malware Infographic
The Cost of Inactivity: Malware InfographicThe Cost of Inactivity: Malware Infographic
The Cost of Inactivity: Malware Infographic
 
Data Center Security Challenges
Data Center Security ChallengesData Center Security Challenges
Data Center Security Challenges
 
Malware and the Cost of Inactivity
Malware and the Cost of InactivityMalware and the Cost of Inactivity
Malware and the Cost of Inactivity
 
Midsize Business Solutions: Cybersecurity
Midsize Business Solutions: CybersecurityMidsize Business Solutions: Cybersecurity
Midsize Business Solutions: Cybersecurity
 
Integrated Network Security Strategies
Integrated Network Security StrategiesIntegrated Network Security Strategies
Integrated Network Security Strategies
 
Cisco Addresses the Full Attack Continuum
Cisco Addresses the Full Attack ContinuumCisco Addresses the Full Attack Continuum
Cisco Addresses the Full Attack Continuum
 
Infonetics Network and Content Security Vendor Scorecard
Infonetics Network and Content Security Vendor ScorecardInfonetics Network and Content Security Vendor Scorecard
Infonetics Network and Content Security Vendor Scorecard
 
Gartner Newsletter: Cisco TrustSec Deployed Across Enterprise Campus, Branch ...
Gartner Newsletter: Cisco TrustSec Deployed Across Enterprise Campus, Branch ...Gartner Newsletter: Cisco TrustSec Deployed Across Enterprise Campus, Branch ...
Gartner Newsletter: Cisco TrustSec Deployed Across Enterprise Campus, Branch ...
 
The Evolution of and Need for Secure Network Access
The Evolution of and Need for Secure Network AccessThe Evolution of and Need for Secure Network Access
The Evolution of and Need for Secure Network Access
 
Cisco 2014 Midyear Security Report
Cisco 2014 Midyear Security ReportCisco 2014 Midyear Security Report
Cisco 2014 Midyear Security Report
 
String of Paerls Infographic
String of Paerls InfographicString of Paerls Infographic
String of Paerls Infographic
 
Midyear Security Report Infographic
Midyear Security Report InfographicMidyear Security Report Infographic
Midyear Security Report Infographic
 
Cisco Annual Security Report Infographic
Cisco Annual Security Report InfographicCisco Annual Security Report Infographic
Cisco Annual Security Report Infographic
 
City of Tomorrow Builds in Next-Generation Security
City of Tomorrow Builds in Next-Generation SecurityCity of Tomorrow Builds in Next-Generation Security
City of Tomorrow Builds in Next-Generation Security
 
Laser Pioneer Secures Network End-to-End to Protect Assets
Laser Pioneer Secures Network End-to-End to Protect AssetsLaser Pioneer Secures Network End-to-End to Protect Assets
Laser Pioneer Secures Network End-to-End to Protect Assets
 

Recently uploaded

TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc
 
A Framework for Development in the AI Age
A Framework for Development in the AI AgeA Framework for Development in the AI Age
A Framework for Development in the AI AgeCprime
 
Generative AI - Gitex v1Generative AI - Gitex v1.pptx
Generative AI - Gitex v1Generative AI - Gitex v1.pptxGenerative AI - Gitex v1Generative AI - Gitex v1.pptx
Generative AI - Gitex v1Generative AI - Gitex v1.pptxfnnc6jmgwh
 
QCon London: Mastering long-running processes in modern architectures
QCon London: Mastering long-running processes in modern architecturesQCon London: Mastering long-running processes in modern architectures
QCon London: Mastering long-running processes in modern architecturesBernd Ruecker
 
Design pattern talk by Kaya Weers - 2024 (v2)
Design pattern talk by Kaya Weers - 2024 (v2)Design pattern talk by Kaya Weers - 2024 (v2)
Design pattern talk by Kaya Weers - 2024 (v2)Kaya Weers
 
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxThe Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxLoriGlavin3
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsPixlogix Infotech
 
Genislab builds better products and faster go-to-market with Lean project man...
Genislab builds better products and faster go-to-market with Lean project man...Genislab builds better products and faster go-to-market with Lean project man...
Genislab builds better products and faster go-to-market with Lean project man...Farhan Tariq
 
Emixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native developmentEmixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native developmentPim van der Noll
 
The Future Roadmap for the Composable Data Stack - Wes McKinney - Data Counci...
The Future Roadmap for the Composable Data Stack - Wes McKinney - Data Counci...The Future Roadmap for the Composable Data Stack - Wes McKinney - Data Counci...
The Future Roadmap for the Composable Data Stack - Wes McKinney - Data Counci...Wes McKinney
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxLoriGlavin3
 
How to write a Business Continuity Plan
How to write a Business Continuity PlanHow to write a Business Continuity Plan
How to write a Business Continuity PlanDatabarracks
 
Potential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and InsightsPotential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and InsightsRavi Sanghani
 
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxPasskey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxLoriGlavin3
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024BookNet Canada
 
The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxLoriGlavin3
 
Testing tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesTesting tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesKari Kakkonen
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024Lonnie McRorey
 
Top 10 Hubspot Development Companies in 2024
Top 10 Hubspot Development Companies in 2024Top 10 Hubspot Development Companies in 2024
Top 10 Hubspot Development Companies in 2024TopCSSGallery
 
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better StrongerModern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better Strongerpanagenda
 

Recently uploaded (20)

TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data PrivacyTrustArc Webinar - How to Build Consumer Trust Through Data Privacy
TrustArc Webinar - How to Build Consumer Trust Through Data Privacy
 
A Framework for Development in the AI Age
A Framework for Development in the AI AgeA Framework for Development in the AI Age
A Framework for Development in the AI Age
 
Generative AI - Gitex v1Generative AI - Gitex v1.pptx
Generative AI - Gitex v1Generative AI - Gitex v1.pptxGenerative AI - Gitex v1Generative AI - Gitex v1.pptx
Generative AI - Gitex v1Generative AI - Gitex v1.pptx
 
QCon London: Mastering long-running processes in modern architectures
QCon London: Mastering long-running processes in modern architecturesQCon London: Mastering long-running processes in modern architectures
QCon London: Mastering long-running processes in modern architectures
 
Design pattern talk by Kaya Weers - 2024 (v2)
Design pattern talk by Kaya Weers - 2024 (v2)Design pattern talk by Kaya Weers - 2024 (v2)
Design pattern talk by Kaya Weers - 2024 (v2)
 
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptxThe Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
The Fit for Passkeys for Employee and Consumer Sign-ins: FIDO Paris Seminar.pptx
 
The Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and ConsThe Ultimate Guide to Choosing WordPress Pros and Cons
The Ultimate Guide to Choosing WordPress Pros and Cons
 
Genislab builds better products and faster go-to-market with Lean project man...
Genislab builds better products and faster go-to-market with Lean project man...Genislab builds better products and faster go-to-market with Lean project man...
Genislab builds better products and faster go-to-market with Lean project man...
 
Emixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native developmentEmixa Mendix Meetup 11 April 2024 about Mendix Native development
Emixa Mendix Meetup 11 April 2024 about Mendix Native development
 
The Future Roadmap for the Composable Data Stack - Wes McKinney - Data Counci...
The Future Roadmap for the Composable Data Stack - Wes McKinney - Data Counci...The Future Roadmap for the Composable Data Stack - Wes McKinney - Data Counci...
The Future Roadmap for the Composable Data Stack - Wes McKinney - Data Counci...
 
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptxMerck Moving Beyond Passwords: FIDO Paris Seminar.pptx
Merck Moving Beyond Passwords: FIDO Paris Seminar.pptx
 
How to write a Business Continuity Plan
How to write a Business Continuity PlanHow to write a Business Continuity Plan
How to write a Business Continuity Plan
 
Potential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and InsightsPotential of AI (Generative AI) in Business: Learnings and Insights
Potential of AI (Generative AI) in Business: Learnings and Insights
 
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptxPasskey Providers and Enabling Portability: FIDO Paris Seminar.pptx
Passkey Providers and Enabling Portability: FIDO Paris Seminar.pptx
 
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
Transcript: New from BookNet Canada for 2024: Loan Stars - Tech Forum 2024
 
The State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptxThe State of Passkeys with FIDO Alliance.pptx
The State of Passkeys with FIDO Alliance.pptx
 
Testing tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examplesTesting tools and AI - ideas what to try with some tool examples
Testing tools and AI - ideas what to try with some tool examples
 
TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024TeamStation AI System Report LATAM IT Salaries 2024
TeamStation AI System Report LATAM IT Salaries 2024
 
Top 10 Hubspot Development Companies in 2024
Top 10 Hubspot Development Companies in 2024Top 10 Hubspot Development Companies in 2024
Top 10 Hubspot Development Companies in 2024
 
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better StrongerModern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
Modern Roaming for Notes and Nomad – Cheaper Faster Better Stronger
 

Managing the Security Impact of Bundled Open Source Software from OSCON

  • 1. Managing the Security Impact of Bundled Third-Party Software Tim Sammut tsammut@cisco.com
  • 2. About me Cisco Security Research & Gentoo Linux Security Team ICASI Third-Party Software Operations Member Security Working Group Chair tsammut@cisco.com underling@gentoo.org
  • 4. Do you produce a product, service or package?
  • 5. Do you disclose vulnerabilities to your customers?
  • 6. Where is third-party software creating security problems for you?
  • 7.  Open Source Software vs. Third-Party Software Quick Level Set  Do we even care about this stuff?  What are we trying to accomplish?
  • 8. It is not our code, but it is our product!
  • 10.  Which packages?  Which versions?  Which compile-time options? Knowing Where  Which kernel versions? TPS is Used Given a vulnerable TPS package can you reliably determine affected products? Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
  • 11.  Exposure expands in under-understood ways  Dependencies are equally exposed to vulnerabilities Understanding  Tools hide build and run-time dependencies Dependencies Focus is often on point requirements without documenting every TPS package incorporated. Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
  • 12.  No naming scheme  Even authoritative names change  Locally modified packages are indistinguishable Inconsistent  Simple input variances Package Naming  Versioning is itself complex Are you able to efficiently process large amounts of TPS usage data? Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
  • 13.  How are development teams choosing which TPS is used?  Are the considering stability or security? Unmanageable  Are they planing for the ongoing maintenance? Selection Processes Are you gaining development-time freedoms at the expense of long-term maintainability? Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
  • 14.  No “Single Source of Truth” Learning of Newly  Disclosure formats, vehicles and time lines vary wildly Disclosed  Monitoring the CVE dictionary is incomplete Vulnerabilities Do you learn of new and relevant TPS vulnerabilities before your customers? Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
  • 15.  Do we wait for a new upstream release?  Do we upgrade? Can we upgrade?  Do we patch? Inconsistent Fixing  Will an upstream fix ever come? of Vulnerabilities  Is the upstream even active? Solving this one time is easy. Do you know what you did last time or across many products? Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
  • 16.  Who is responsible to fix the issue? External  How quickly?  In what cases? Development  And for how long? Partners  Are each of the previous challenges covered? Combining TPS and external partners creates efficiency and vast unknowns that must be managed. Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
  • 17. What other challenges exist? Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
  • 19. Absolutely critical and foundational to success Build a Strong Catalog of TPS Use Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
  • 20. Creates tremendous efficiencies throughout the problem space Standardize Everything Possible Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
  • 21. Must produce a consistent vulnerability feed for internal consumption Monitor Vulnerability Disclosure Scalably Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
  • 22. Key to understanding today's impact and the historic record Instrument the Bug Database Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
  • 23. Support and require the equivalent of internal processes Require Contract Language with Partners Knowing Where TPS is Understanding Inconsistent Package Unmanageable Learning of Inconsistent Fixes External Development Used Dependencies Naming Selection Processes Vulnerabilities Partners
  • 24. Questions? It is not our code, but it is our product!