AppSec Europe 2016

A new entrant to the OWASP Top 10 2013 ranking was A9 - Using components with Known vulnerabilities. Increasingly, the compromise point of an application has not been due to code that has originated in house, the 2015 Data Breach Investigations Report states 97% of attack mediums can be traced to 10 CVES. Standards like PCI-DSS call for auditing and constant monitoring of the status of these components, but often this leads to controls outside the realm of what is scaleable. Luckily, security of can be and is a developer choice as much as a process. In this session we talk through what can be done to implement a process that helps lower compound risk from 3rd party suppliers as early in the software lifecycle as is possible, and how to help facilitate security as a part of the DevOps culture