Look Who it Was Random video

11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey - OWASP AppSecUSA 2014

182 views · Published 23 September 2014 · 46:54 · Indexed 30 October 2026

Channel: OWASP Foundation · 2014 · Science & Technology

Watch on YouTube

Recorded at AppSecUSA 2014 in Denver
http://2014.appsecusa.org/

Thursday, September 18 • 1:00pm - 1:45pm

11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey

In 2013, OWASP updated its top 10 list to include “(A9) Avoiding the use of open source components with known vulnerabilities.” The guideline was added as OWASP leaders came to understand that 90% of a typical application is composed of open source components.

In this session, a senior panel of application security experts will share and discuss the results of a four-year, industry-wide study on application security practices, drivers, and trends within the open source development community. To date, over 11,000 professionals have participated in the study.

Among the surprising survey responses, panelists will share their perspectives on:

 75% of organizations are not enforcing their open source policies
 Only 16% of participants must prove they are not using components with known vulnerabilities
 64% don't track changes in open source vulnerability data

This annual study in 2014 was run during the month of April, right in the wake of the notorious open source Heartbleed bug announcement. Over 3,000 participated in the 2014 study with results directly reflecting the state of organization's preparedness to react to Heartbleed and any future vulnerabilities.

Moderator

Derek E. Weeks
Vice President, Sonatype
This year, I am leading a panel discussion at AppSec USA (Sept) and LASCON (Oct): 11,000 Voices: Experts Shed Light on 4-Year Open Source & AppSec Survey. | | Panelists include Jeff Williams (Contrast Security), Matt Johanssen (White Hat Security), Damon Edwards (SimplifyOps), Matt Tesauro (Rackspace), Oleg Gryb (Samsung), James Wickett (Signal Sciences), Ryan Berg (Sonatype), Josh Corman (Sonatype, iamthecavalry).


-

Managed by the official OWASP Media Project https://www.owasp.org/index.php/OWASP_Media_Project

More from this channel