Eskenzi PR Eskenzi PR
  • About Us
Friday, 23 April, 2021
IT Security Guru
Eskenzi PR
  • Home
  • Features
  • Insight
  • Events
    • Women in Cyber 2020
    • Women in Cyber 2020 [SPONSORS]
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Women in Cyber 2020
    • Women in Cyber 2020 [SPONSORS]
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us
No Result
View All Result
IT Security Guru
No Result
View All Result

Sonatype 2017 State of the Software Supply Chain Report: DevOps Practices Reduce Use of Defective Open Source Components by 63%

by The Gurus
July 18, 2017
in Editor's News
Share on FacebookShare on Twitter

Sonatype, the leader in software supply chain automation, today announced the release of its third annual State of the Software Supply Chain Report. This year’s report highlights risks lurking within open source software components and quantifies the empirical benefits of actively managing software supply chain hygiene.
 
Organizations that are actively managing the quality of open source components flowing into production applications are realizing a 28 percent improvement in developer productivity, a 30 percent reduction in overall development costs, and a 48 percent increase in application quality. Furthermore, analysis of more than 17,000 applications reveals that applications built by teams utilizing automated governance tools reduced the percentage of defective components by 63%.
 
Conversely, organizations failing to manage software supply chains are unwittingly releasing vulnerable applications into production, wasting thousands of hours on rework and bug fixes, and facing increased liability due to gross negligence.
 
Additional key findings of the 2017 State of the Software Supply Chain report include:
 
Consumption of open source components is growing on a massive scale

  • Year-over-year downloads of Java components grew 68 percent (52 billion in 2016), JavaScript downloads grew 262 percent (59 billion in 2016), and demand for Docker components is expected to grow 100 percent (12 billion downloads).
  • Faced with a near infinite supply of open source components, high-functioning DevOps organizations are utilizing machine automation to govern the quality of open source components flowing through their software supply chains.

 
Open source component suppliers remain slow to fix vulnerabilities

  • Even when vulnerabilities are known, OSS projects are slow to remediate – if they do so at all. Only 15.8 percent of OSS projects actively fix vulnerabilities, and even then the mean time to remediation was 233 days.
  • This puts the onus on DevOps organizations to actively govern which OSS projects they work with, and which components they ultimately consume.

 
Number of downloaded components with known vulnerabilities is slightly decreasing

  • In 2016, the percent of Java components downloaded from the Central Repository that contained known security vulnerabilities fell to 5.5 percent (1 in 18), down from 6.1 percent the year prior.
  • Although this defect download ratio is far from perfect, there is empirical evidence that hygiene is beginning to improve with ratios declining slightly in each of the last three years.

 
The regulatory landscape is rapidly changing

  • In the past year in the United States, the White House, four federal agencies, and the automotive industry have released new guidelines to improve the quality, safety, and security of software supply chains.

 
Supporting Quotes
Wayne Jackson, CEO, Sonatype
“Companies are no longer building software applications from scratch, they are manufacturing them as fast as they can using an infinite supply of open source component parts. However, many still rely on manual and time consuming governance and security practices instead of embracing DevOps-native automation. Our research continues to show that development teams managing trusted software supply chains are dramatically improving quality and productivity.”
 
Mark Driver, Felix Gaehtgens, Mark O’Neill, Gartner, May 2017 report “Managing Digital Trust in the Software Development Life Cycle”
“By 2020, 50% of organizations will have suffered damage caused by failing to manage trust in their, or their partners’, software development life cycles (SDLC) – causing revenue loss of more than 15%. Application leaders responsible for modernizing application development should re-evaluate the SDLC in the form of a trusted software supply chain, with varied levels of trust.”

0 0 vote
Article Rating
FacebookTweetLinkedIn
Tags: CyberDevOpssecuritySoftwareTechnology
ShareTweetShare
Previous Post

How do SMEs fight off cyber-attacks?

Next Post

A UK business will spend more than £1m recovering from a data security breach – NTT Security 2017 Risk:Value

Subscribe
Notify of
guest
guest
0 Comments
Inline Feedbacks
View all comments

Recent News

messaging apps - signal

Signal CEO hacks mobile-hacking firm

April 22, 2021
New UK laws to protect IoT devices amid sales surge

New UK laws to protect IoT devices amid sales surge

April 22, 2021
edgescan logo

PRODUCT REVIEW – Edgescan makes fullstack vulnerability management easy

April 21, 2021
The clubhouse app

Armis and UK’s Eseye partner to secure connected devices on any cellular network

April 20, 2021

The IT Security Guru offers a daily news digest of all the best breaking IT security news stories first thing in the morning! Rather than you having to trawl through all the news feeds to find out what’s cooking, you can quickly get everything you need from this site!

Our Address: 10 London Mews, London, W2 1HY

Follow Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

  • About Us
No Result
View All Result
  • Home
  • Features
  • Insight
  • Events
    • Women in Cyber 2020
    • Women in Cyber 2020 [SPONSORS]
  • Topics
    • Cloud Security
    • Cyber Crime
    • Cyber Warfare
    • Data Protection
    • DDoS
    • Hacking
    • Malware, Phishing and Ransomware
    • Mobile Security
    • Network Security
    • Regulation
    • Skills Gap
    • The Internet of Things
    • Threat Detection
    • AI and Machine Learning
    • Industrial Internet of Things
  • Multimedia
  • Product Reviews
  • About Us

© 2015 - 2019 IT Security Guru - Website Managed by Calm Logic

This site uses functional cookies and external scripts to improve your experience.

More information
wpDiscuz
0
0
Would love your thoughts, please comment.x
()
x
| Reply
Privacy Settings / PENDINGGDPR Compliance

Privacy Settings / PENDING

This site uses functional cookies and external scripts to improve your experience. Which cookies and scripts are used and how they impact your visit is specified on the left. You may change your settings at any time. Your choices will not impact your visit.

NOTE: These settings will only apply to the browser and device you are currently using.

GDPR Compliance

Accept