Sonatype

344 Seguidores

Every day, developers rely on millions of third party and open source building blocks – known as components – to build the software that runs our world. Sonatype ensures that only the best components are used throughout the software development lifecycle so that organizations don't have to make the tradeoff between going fast and being secure. Policy automation, ongoing monitoring and proactive alerts makes it easy to have full visibility and control of components throughout the software supply chain so that applications start secure and remain that way over time. Sonatype is privately held with investments from New Enterprise Associates (NEA), Accel Partners, Bay Partners, Hummer Winbla

devops all day devops capital one ansible continuous delivery sonatype docker puppet jenkins rugged devops chef devsecops owasp open source systems hardening security policy iam intuit kms blue team aws kms security monitoring multi-security checkpoints red team mesosphere container orchestrator refactor aws lambda rancher labs infrastructure as code immutable infrastructure microservices refactoring aws serverless kubernetes continuous deployment enterprise transformations bamboo meta infrastructure as code monolithic architectures continuous everyone roles devops legacy apps teamcity waterfall legacy apps culture tools application security fannie mae marathon infrastructure open source governance software security risks agile secure devops purpose automating security security open source security monitoring containers sonatype nexus nexus maven java agile software development open source development software development information security component security nexus pro component lifecycle management reference architecture support server continuous pipeline automated security code policy jira josh corman devopssec gene kim appdev mark miller appsec chris eng component vulnerabilities oss security risks software development risks repository management repository manager sdlc ci/cd devsevops nexus repository nexus firewall nexus lifecycle threadfix nessus owasp depedency check gaunltl find bugs owasp zap aqua contrast twistlock sonarqube hp fortify application development discovery alerting continuous integration servers google terraform static analysis architecture pipeline stacking codes software compliance software testing platform checkpoint forensics clustering application docker hub docker private registry policy guidelines success eclipse gradle sonar software supply chains rundeck ant software supply chain automation rsa dell deming artifactory artifact repository 2015 jez humble github subversion continuous integraton software supply chain supply chain vulnerable components clm europe joshua corman security news infosec matt tesauro game show data breaches heartbleed risk management struts pci requirements component repository repository

Actividad
Acerca de

Snippets, Scans and Snap Decisions: How Component Identification Methods Impact the Efficiency of Open Source Risk Management

Hace 8 años • 430 Visualizaciones

Sonatype

Presentaciones

Documentos

Infografías

Recomendaciones