Open Source vulnerability management for software development and cloud environments

Download Slides

Watch Video

Security vulnerabilities can quickly arise in the software development process, such as SQL or XSS injections, configuration errors in the Infrastructure as Code or security vulnerabilities in integrated libraries. You don’t have to use commercial tools to detect and manage vulnerabilities. The Open Source ecosystems provides a lot of powerful tools, that can be used very efficiently.

The talk introduces a straightforward process how to detect and mitigate vulnerabilities and shows a demonstration, how to use Open Source tools to support the process.

Nowadays, almost all companies develop software which is available on the internet, be it mobile apps, web apps or APIs to connect customers and partners. Security vulnerabilities can quickly arise in the software development process, such as SQL or XSS injections, configuration errors in the Infrastructure as Code or security vulnerabilities in integrated libraries. This makes vulnerability management an important factor in preventing the software from becoming a gateway for attackers. In addition to commercial products, there is also a steadily growing open source ecosystem available for this purpose. The talk will discuss:

What are the most important steps in vulnerability management in software development?
What are the advantages but also the limitations of open source tools for vulnerability management compared to commercial products?
How easy is it to integrate open source vulnerability scanners into the development process?
Why is the use of an Open Source vulnerability management system such as SecObserve important?
How can the results used to improve other processes

In addition to the slides, the talk will also show a practical example of how vulnerability scanners can be integrated into a CI/CD pipeline and how the results can be assessed in the Open Source vulnerability management system SecObserve.

About the Speaker

Stefan Fleckenstein

After many years in software development, Stefan Fleckenstein took over responsibility for MaibornWolff’s internal IT infrastructure and software development as CIO from 2010 to 2020, in addition to his work in customer projects. Information security became one of the focal points of his work during this time, in which he led MaibornWolff to the ISO 27001 certification. Combining his experiences from software development and information security, Stefan founded the Cybersecurity division at MaibornWolff, which advises and supports customers on all matters relating to security.

In addition to his work as a department head, Stefan is passionate about vulnerability management and developing open source software. He is an active member of the SBOM and VEX community and maintainer of the Open Source vulnerability management system SecObserve (https://github.com/MaibornWolff/SecObserve).