The Log4shell vulnerability found in the Log4j logging framework has been recognised as one of the most critical vulnerabilities ever, open source or otherwise. And, while the dangers of the Log4j vulnerability remain high, even 4 months out, the situation has highlighted an even bigger issue that is plaguing security professionals and developers: if you don’t know what’s in your software supply chain, you’re already behind.

When a flaw is disclosed, companies are instantly thrust into a race against time to fix it before it can be exploited by an attacker, meaning every minute counts. If you don’t know what’s in your software, you’re effectively giving hackers a huge head start.

While this outlook might seem bleak, Adam will easy steps you can take to significantly mitigate risk.

Third party open-source libraries make up the bulk of most modern applications. Leveraging them allows us to build faster by providing functionality which we would otherwise have to write ourselves. However, not all open-source libraries are created equal, and poor third-party management can result in vulnerabilities being introduced into our applications.

In this session, we will look at just how much open source our applications are using and review some common third-party management gaps in most typical AppSec programs. We will also look at several AppSec best practice approaches for better third-party management.