Канал: Sonatype

Understanding Open Source Security: Vulnerabilities vs. Malware

Understanding Open Source Security: Vulnerabilities vs. Malware

Vulnerability Exploitability eXchange (VEX) Demo

Vulnerability Exploitability eXchange (VEX) Demo

How to Audit SBOMs: A Sonatype Demo

How to Audit SBOMs: A Sonatype Demo

Regulate to Innovate: Navigating Software Regulations, SBOMs and Beyond

Regulate to Innovate: Navigating Software Regulations, SBOMs and Beyond

Regulate to Innovate: Navigating Software Security & Regulations for Medical Devices

Regulate to Innovate: Navigating Software Security & Regulations for Medical Devices

Getting Started with SBOMs

Getting Started with SBOMs

SBOM Manager Demo

SBOM Manager Demo

Sonatype Lifecycle Demo across SDLC

Sonatype Lifecycle Demo across SDLC

Lifecycle Demo Video

Lifecycle Demo Video

UPDATE: XZ library attack

UPDATE: XZ library attack

SBOM 101: What is an SBOM?

SBOM 101: What is an SBOM?

SBOM Manager: Everything you need to know with Stephen Magill, VP of Product Innovation at Sonatype

SBOM Manager: Everything you need to know with Stephen Magill, VP of Product Innovation at Sonatype

Why SBOM Manager? Control and share the software you consume.

Why SBOM Manager? Control and share the software you consume.

NVD Overloaded: The Bad Guys Didn’t Take a Break, Your SCA Tool Did

NVD Overloaded: The Bad Guys Didn’t Take a Break, Your SCA Tool Did

Quick Wins with the IDE Plugins

Quick Wins with the IDE Plugins

Dissecting Two Emerging Threats: Ledger Breach & Struts2 Vulnerability

Dissecting Two Emerging Threats: Ledger Breach & Struts2 Vulnerability

Sonatype Nexus Repository Pro

Sonatype Nexus Repository Pro

A First Look: 9th Annual State of the Software Supply Chain Report

A First Look: 9th Annual State of the Software Supply Chain Report

9th Annual State of the Software Supply Chain Report

9th Annual State of the Software Supply Chain Report

Sonatype Platform Browser Extension

Sonatype Platform Browser Extension

Best Practices: Repository Firewall Waivers

Best Practices: Repository Firewall Waivers

Data Insights

Data Insights

How It Works: Sonatype Lifecycle

How It Works: Sonatype Lifecycle

Live from Infosecurity Europe 2023: Sonatype Repository Firewall Now Available as a SaaS Solution

Live from Infosecurity Europe 2023: Sonatype Repository Firewall Now Available as a SaaS Solution

How It Works: Sonatype Repository Firewall

How It Works: Sonatype Repository Firewall

Dev Chat with Dan Conn: SBOMs Unwrapped - A Guide to Getting Started

Dev Chat with Dan Conn: SBOMs Unwrapped - A Guide to Getting Started

Dev Chat with Dan Conn: Beware of Malware

Dev Chat with Dan Conn: Beware of Malware

A Live Discussion: White House National Cyber Security Strategy

A Live Discussion: White House National Cyber Security Strategy

Run Anywhere with Sonatype

Run Anywhere with Sonatype

Meet Richard Panman: Sonatype Values Champion

Meet Richard Panman: Sonatype Values Champion

Meet Ankita Lamba: Sonatype Values Champion

Meet Ankita Lamba: Sonatype Values Champion

A Deep Dive Into OpenSSL's Two Serious Vulnerabilities

A Deep Dive Into OpenSSL's Two Serious Vulnerabilities

Live from #DOES22 - The 8th Annual State of the Software Supply Chain Report

Live from #DOES22 - The 8th Annual State of the Software Supply Chain Report

Software Supply Chain Management is How We Innovate

Software Supply Chain Management is How We Innovate

Software Supply Chain Management is Everyone's Job

Software Supply Chain Management is Everyone's Job

Software Supply Chain Management is Intelligent Automation

Software Supply Chain Management is Intelligent Automation

Software Supply Chain Management is Sonatype

Software Supply Chain Management is Sonatype

This Week in Malware: VMWare, Secrets, and Security by Obscurity

This Week in Malware: VMWare, Secrets, and Security by Obscurity

This week in malware—a 'fix-crash' info-stealer and 500+ malicious npm packages

This week in malware—a 'fix-crash' info-stealer and 500+ malicious npm packages

Wicked Good Development: What is Spring4Shell? And Why Should I Care

Wicked Good Development: What is Spring4Shell? And Why Should I Care

New Spring Framework RCE Vulnerability Confirmed (Springshell) - What You Need to Know

New Spring Framework RCE Vulnerability Confirmed (Springshell) - What You Need to Know

Meet an Open Source Project Maintainer - Q&A

Meet an Open Source Project Maintainer - Q&A

Make Your First Github Repository with Women at Sonatype!

Make Your First Github Repository with Women at Sonatype!

Critical Log4j Vulnerability Still Being Downloaded 40% of the Time

Critical Log4j Vulnerability Still Being Downloaded 40% of the Time

Dissecting the Log4j Vulnerability

Dissecting the Log4j Vulnerability

Critical New 0-day Vulnerability in Popular Log4j Library Affecting Applications in Mass

Critical New 0-day Vulnerability in Popular Log4j Library Affecting Applications in Mass

Sonatype & Climb CISO Europe

Sonatype & Climb CISO Europe

Sonatype at Grace Hopper Celebration

Sonatype at Grace Hopper Celebration

08 - Getting Help - Easy Publishing to Central Repository

08 - Getting Help - Easy Publishing to Central Repository

07 - Javadoc, Sources and Signing - Easy Publishing to Central Repository

07 - Javadoc, Sources and Signing - Easy Publishing to Central Repository

06 - Project Object Model (POM) - Easy Publishing to Central Repository

06 - Project Object Model (POM) - Easy Publishing to Central Repository

05 - First Deployments - Easy Publishing to Central Repository

05 - First Deployments - Easy Publishing to Central Repository

04 - Accessing OSS-RH - Easy Publishing to Central Repository

04 - Accessing OSS-RH - Easy Publishing to Central Repository

03 - Requirements and Signing Tips for OSS-RH - Easy Publishing to Central Repository

03 - Requirements and Signing Tips for OSS-RH - Easy Publishing to Central Repository

02 - Applying for Access to OSS-RH - Easy Publishing to Central Repository

02 - Applying for Access to OSS-RH - Easy Publishing to Central Repository

01 - Claim Your Namespace - Easy Publishing to Central Repository

01 - Claim Your Namespace - Easy Publishing to Central Repository

Module 16: A Practical Example with OSSRH and the Central Repository (OSS)

Module 16: A Practical Example with OSSRH and the Central Repository (OSS)

Rise of the Next Gen Software Supply Chain, A Fireside Chat

Rise of the Next Gen Software Supply Chain, A Fireside Chat

Full Spectrum Software Supply Chain Automation

Full Spectrum Software Supply Chain Automation

Biden Executive Order on Cybersecurity Calls for Enhanced Software Supply Chain Security

Biden Executive Order on Cybersecurity Calls for Enhanced Software Supply Chain Security

Breaking Down 3 Major Open Source Security Incidents This Week

Breaking Down 3 Major Open Source Security Incidents This Week

What You Need to Know about the Codecov Software Supply Chain Attack

What You Need to Know about the Codecov Software Supply Chain Attack

Meet the Developers Behind Sonatype's Release Integrity

Meet the Developers Behind Sonatype's Release Integrity

Securing Software Supply Chains

Securing Software Supply Chains

Dependency Hijacking Software Supply Chain Attack Hits More Than 35 Organizations

Dependency Hijacking Software Supply Chain Attack Hits More Than 35 Organizations

Mystery Solved: Sonatype Makes Developers' Lives Easier

Mystery Solved: Sonatype Makes Developers' Lives Easier

SolarWinds Update - New Software Supply Chain Attack Vector Identified

SolarWinds Update - New Software Supply Chain Attack Vector Identified

Tracking the SolarWinds Software Supply Chain Attack

Tracking the SolarWinds Software Supply Chain Attack

The SolarWinds Software Supply Chain Attack: How Developers Can Protect Applications

The SolarWinds Software Supply Chain Attack: How Developers Can Protect Applications

Meet the Company - Learn More About Sonatype

Meet the Company - Learn More About Sonatype

JavaScript Dependency Management

JavaScript Dependency Management

Discover the Nexus Platform

Discover the Nexus Platform

Sonatype-2020-0003 - npm malicious package 1337qq-js

Sonatype-2020-0003 - npm malicious package 1337qq-js

Customize Our Educational Content for Team On-boarding

Customize Our Educational Content for Team On-boarding

Hands On with the Nexus Platform

Hands On with the Nexus Platform

Maturing DevOps in TD Bank

Maturing DevOps in TD Bank

Where We've Been. Where We Are. Where We're Going.

Where We've Been. Where We Are. Where We're Going.

Tools, Not Rules!

Tools, Not Rules!

Squash Those Vulnerabilities! ...Where Do I Start?

Squash Those Vulnerabilities! ...Where Do I Start?

Becoming an OSS Champion: Top Three Things to Avoid the Pitchforks

Becoming an OSS Champion: Top Three Things to Avoid the Pitchforks

Empowering Developers: Security Self Serve and Automated Time-Based Waivers

Empowering Developers: Security Self Serve and Automated Time-Based Waivers

The Path Forward for the Nexus Platform

The Path Forward for the Nexus Platform

The Nexus Community: Solutions, Ideas and Answers About the Nexus Platform

The Nexus Community: Solutions, Ideas and Answers About the Nexus Platform

How to Prevent Developers from Coming at You with Valyrian Steel

How to Prevent Developers from Coming at You with Valyrian Steel

Nexus Firewall: The Rules of the Game Have Changed. What Will You Do?

Nexus Firewall: The Rules of the Game Have Changed. What Will You Do?

How (and why) to Build Your Own DevSecOps Team

How (and why) to Build Your Own DevSecOps Team

Putting the "Sec" into DevSecOps

Putting the "Sec" into DevSecOps

DevSecOps Without Compromise: Cloudogu EcoSystem and Sonatype

DevSecOps Without Compromise: Cloudogu EcoSystem and Sonatype

Containers Are Just Another Piece of the Puzzle - Protect Them To Secure Your Business

Containers Are Just Another Piece of the Puzzle - Protect Them To Secure Your Business

DevOps Culture: The Neuroscience of Behavior

DevOps Culture: The Neuroscience of Behavior

Comprehensive Guide to Lifecycle Scanning

Comprehensive Guide to Lifecycle Scanning

DevSecOps: Security at the Speed of DevOps

DevSecOps: Security at the Speed of DevOps

Building Container Based Pipelines in AWS

Building Container Based Pipelines in AWS

The Case for Software Bill of Materials (Friedman)

The Case for Software Bill of Materials (Friedman)

Top 5 Tomcat Vulnerabilities Demonstrated

Top 5 Tomcat Vulnerabilities Demonstrated

Component Intelligence at the Source

Component Intelligence at the Source

OSS for Enterprise: Procure Secure Components Faster & Manage Risk Better

OSS for Enterprise: Procure Secure Components Faster & Manage Risk Better

Securing Developers and Open Source Components

Securing Developers and Open Source Components

Immutabe Infrastructure as Artifacts- Nexus as a Single Point of Control -Mykel Alvis (copy)

Immutabe Infrastructure as Artifacts- Nexus as a Single Point of Control -Mykel Alvis (copy)

DevOps Table Stakes: The Minimum Amount Required to Play the Game

DevOps Table Stakes: The Minimum Amount Required to Play the Game

RedHat

RedHat

Rolling Out Nexus in a Large Organization (Chris Bolton and Jasmine James)

Rolling Out Nexus in a Large Organization (Chris Bolton and Jasmine James)

Repository Management: It's Not Just for the JVM

Repository Management: It's Not Just for the JVM

Operating Without an OSS License? That Could Be Dangerous!

Operating Without an OSS License? That Could Be Dangerous!

Securing Developers and Open Source Components

Securing Developers and Open Source Components

Secure Open Source Dependencies with Sonatype DepShield

Secure Open Source Dependencies with Sonatype DepShield

Automate Open Source Governance for GDPR Compliance

Automate Open Source Governance for GDPR Compliance

Nexus Platform Overview

Nexus Platform Overview

Automate Open Source Governance Across the SDLC at Scale

Automate Open Source Governance Across the SDLC at Scale

Automate Open Source Governance for GDPR Compliance (Subtitles)

Automate Open Source Governance for GDPR Compliance (Subtitles)

Français: Software Supply Chain | Sonatype

Français: Software Supply Chain | Sonatype

Sonatype Nexus - China

Sonatype Nexus - China

Deutsch: The Software Supply Chain | Sonatype

Deutsch: The Software Supply Chain | Sonatype

Create a Trusted Software Supply Chain with Nexus Platform

Create a Trusted Software Supply Chain with Nexus Platform

Trust but verify with the Nexus Platform

Trust but verify with the Nexus Platform

Life is Better in the Land of Truth

Life is Better in the Land of Truth

Nexus Platform for Go Development Teams

Nexus Platform for Go Development Teams

CircleCI Maven Release Orb

CircleCI Maven Release Orb

Staging and Tagging in Nexus Repository Professional 3.11

Staging and Tagging in Nexus Repository Professional 3.11

How to set up a Yum Proxy Repo in Nexus Repository Manager 3.5

How to set up a Yum Proxy Repo in Nexus Repository Manager 3.5

DevSecOps Delivered- Nexus Firewall Reporting with Nexus Repository Manager

DevSecOps Delivered- Nexus Firewall Reporting with Nexus Repository Manager

Nexus Repository 3.20 - R Format Support

Nexus Repository 3.20 - R Format Support

Deploy Nexus Repository on Mesospher DCOS.

Deploy Nexus Repository on Mesospher DCOS.

Mesosphere's Enterprise DC/OS environment & Nexus Repository

Mesosphere's Enterprise DC/OS environment & Nexus Repository

How To Empower Developers With Nexus

How To Empower Developers With Nexus

IntelliJ and Vulnerability Search with Nexus IQ Server and Nexus Lifecycle

IntelliJ and Vulnerability Search with Nexus IQ Server and Nexus Lifecycle

Policy-oriented Reporting with Nexus Lifecycle

Policy-oriented Reporting with Nexus Lifecycle

Nexus Lifecycle: Container Vulnerability Management with Clair

Nexus Lifecycle: Container Vulnerability Management with Clair

Nexus Lifecycle: Automated Pull Requests in GitHub

Nexus Lifecycle: Automated Pull Requests in GitHub

License Obligation Review using Nexus Lifecycle

License Obligation Review using Nexus Lifecycle

Nexus Lifecycle: How to identify newly vulnerable components across your application portfolio

Nexus Lifecycle: How to identify newly vulnerable components across your application portfolio

Google Chrome Extension using Nexus IQ Server

Google Chrome Extension using Nexus IQ Server

DevSecOps Delivered- Fix an Open Source Vulnerability from within the IDE

DevSecOps Delivered- Fix an Open Source Vulnerability from within the IDE

Finding Python Vulnerabilities with Nexus Lifecycle

Finding Python Vulnerabilities with Nexus Lifecycle

DevSecOps for Containers - Nexus Lifecycle Container Analysis

DevSecOps for Containers - Nexus Lifecycle Container Analysis

DevSecOps Delivered - AHC and Struts

DevSecOps Delivered - AHC and Struts

How to Find and Remediate a Critical Pivotal Spring Vulnerability with Nexus Lifecycle

How to Find and Remediate a Critical Pivotal Spring Vulnerability with Nexus Lifecycle

Zealot - A New Malware Campaign Leveraging Struts2 and the NSA Hacks

Zealot - A New Malware Campaign Leveraging Struts2 and the NSA Hacks

Deploy Nexus Lifecycle on Mesospher DCOS.

Deploy Nexus Lifecycle on Mesospher DCOS.

How to Configure Policy Grandfathering within Nexus Lifecycle

How to Configure Policy Grandfathering within Nexus Lifecycle

Jenkins Plugin for Nexus Lifecycle Pushes Component Intellience into GitHub

Jenkins Plugin for Nexus Lifecycle Pushes Component Intellience into GitHub

Microsoft Visual Studio & Nexus Lifeycle

Microsoft Visual Studio & Nexus Lifeycle

Nexus Lifecycle offers expanded coverage with XC.

Nexus Lifecycle offers expanded coverage with XC.

Success Metrics Dashboard in Nexus Lifecycle

Success Metrics Dashboard in Nexus Lifecycle

Nexus Firewall for RPM/YUM

Nexus Firewall for RPM/YUM

Policy Grandfathering in Nexus Lifecycle: Automate OSS Governance at Your Own Pace.

Policy Grandfathering in Nexus Lifecycle: Automate OSS Governance at Your Own Pace.

DevSecOps Delivered- Nexus Firewall for RubyGems

DevSecOps Delivered- Nexus Firewall for RubyGems

Nexus Firewall Now Supports Artifactory Repositories

Nexus Firewall Now Supports Artifactory Repositories

Nexus Firewall Demo with Browser

Nexus Firewall Demo with Browser

Nexus Firewall blocks bad components from entering Nexus Repo OSS.

Nexus Firewall blocks bad components from entering Nexus Repo OSS.

Nexus Firewall Demo with Eclipse

Nexus Firewall Demo with Eclipse

How the Nexus Platform Works

How the Nexus Platform Works

Sonatype - Come Work With Us

Sonatype - Come Work With Us

Nexus Intelligence Insights CVE-2019-15753

Nexus Intelligence Insights CVE-2019-15753

0 + 2 = 153 | Adding two dependencies to a Go codebase

0 + 2 = 153 | Adding two dependencies to a Go codebase

Sonatype's CTO Brian Fox Talks About the Next Generation of Nexus Intelligence

Sonatype's CTO Brian Fox Talks About the Next Generation of Nexus Intelligence

Policy-oriented Reporting with Nexus Lifecycle

Policy-oriented Reporting with Nexus Lifecycle

Using Webhooks to Integrate Nexus Lifecycle with Quay

Using Webhooks to Integrate Nexus Lifecycle with Quay

CVE-2019-0232 Apache Tomcat remote code execution

CVE-2019-0232 Apache Tomcat remote code execution

The Shifting Landscape of Open Source Attacks

The Shifting Landscape of Open Source Attacks

Sonatype - All In

Sonatype - All In

Installing Nexus IQ in AWS EKS

Installing Nexus IQ in AWS EKS

Finding Python Vulnerabilities with Sonatype Nexus Lifecycle

Finding Python Vulnerabilities with Sonatype Nexus Lifecycle

Nexus IQ - Brief Introduction

Nexus IQ - Brief Introduction

Nexus Repository Pro Role-Based Access Control Screencast

Nexus Repository Pro Role-Based Access Control Screencast

Sonatype: APJ Webinar How to manage your open source vulnerabilities

Sonatype: APJ Webinar How to manage your open source vulnerabilities

Episode 04 - Manage a Secure Private Docker Registry with Sonatype Nexus and ACM

Episode 04 - Manage a Secure Private Docker Registry with Sonatype Nexus and ACM

Episode 02: Build an AWS VPC Using Infrastructure as Code

Episode 02: Build an AWS VPC Using Infrastructure as Code

Episode 01: CICD on AWS Workshop Series

Episode 01: CICD on AWS Workshop Series

Episode 03: Deploy a Highly Available Jenkins Cluster on AWS

Episode 03: Deploy a Highly Available Jenkins Cluster on AWS

The Data Behind the Equifax Breach - Fox Business News - Bill Karpovich

The Data Behind the Equifax Breach - Fox Business News - Bill Karpovich

The DevSecOps Experiment with DJ Schleen

The DevSecOps Experiment with DJ Schleen

event-stream: Analysis of a Compromised npm package

event-stream: Analysis of a Compromised npm package

Derek Weeks - DOES 2018 Lightning Talk

Derek Weeks - DOES 2018 Lightning Talk

Derek Weeks and Scott Coulton, All Day DevOps 2018 speaker preview

Derek Weeks and Scott Coulton, All Day DevOps 2018 speaker preview

Derek Weeks and George Swan - All Day DevOps Keynote Sneak Peek

Derek Weeks and George Swan - All Day DevOps Keynote Sneak Peek

2018 All Day DevOps - Are you ready for October 17?

2018 All Day DevOps - Are you ready for October 17?

DevSecOps Delivered - Dashboards and Success Metrics within Nexus IQ Server

DevSecOps Delivered - Dashboards and Success Metrics within Nexus IQ Server

DevSecOps Delivered - Reports in .Net with Nexus IQ Server

DevSecOps Delivered - Reports in .Net with Nexus IQ Server

DevSecOps Delivered: Integrating Jira and Bamboo with Nexus IQ Server

DevSecOps Delivered: Integrating Jira and Bamboo with Nexus IQ Server

DevSecOps Delivered: Scan a Docker Image with Nexus IQ Server

DevSecOps Delivered: Scan a Docker Image with Nexus IQ Server

DevSecOps Delivered: Security and Licensing Policies with Nexus IQ Server

DevSecOps Delivered: Security and Licensing Policies with Nexus IQ Server

DevSecOps Delivered: Integrate Nexus IQ Server with Jenkins

DevSecOps Delivered: Integrate Nexus IQ Server with Jenkins

DevSecOps Delivered: Nexus Firewall for RubyGems

DevSecOps Delivered: Nexus Firewall for RubyGems

DevSecOps Delivered: Nexus Firewall Reporting with Nexus Repository Manager

DevSecOps Delivered: Nexus Firewall Reporting with Nexus Repository Manager

DevSecOps Delivered: Using Nexus Firewall with Nexus Repository Manager

DevSecOps Delivered: Using Nexus Firewall with Nexus Repository Manager

Fannie Mae: Scaling the DevOps Enterprise (Barry Snyder)

Fannie Mae: Scaling the DevOps Enterprise (Barry Snyder)

Open Source Developers and Infrastructure are the New Front Line of Security (Brian Fox)

Open Source Developers and Infrastructure are the New Front Line of Security (Brian Fox)

Objective Learning: Educational Resources to Make Your a Kickass Nexus User (Brianne Strozewski)

Objective Learning: Educational Resources to Make Your a Kickass Nexus User (Brianne Strozewski)

Build Better Component Practices: Crawl. Walk. Run. (Chris Carlucci)

Build Better Component Practices: Crawl. Walk. Run. (Chris Carlucci)

A Dive into Reference Governance Policies for Nexus Lifecycle (Chris Tolo)

A Dive into Reference Governance Policies for Nexus Lifecycle (Chris Tolo)

Removing License and Security Risk for CD with IQ Server (David Slater)

Removing License and Security Risk for CD with IQ Server (David Slater)

The "Ops" Side of DevSecOps (Damon Edwards)

The "Ops" Side of DevSecOps (Damon Edwards)

We Are All Equifax (Derek Weeks )

We Are All Equifax (Derek Weeks )

Kaiser Permanente: Eliminating Vulnerable Libraries Before They Enter Your DevOps Pipeline (Xin Xu)

Kaiser Permanente: Eliminating Vulnerable Libraries Before They Enter Your DevOps Pipeline (Xin Xu)

Towards Personalised Precision Medicine - A Technical Overview (Tudor Groza)

Towards Personalised Precision Medicine - A Technical Overview (Tudor Groza)

5 Lightning Solutions on the Nexus Platform (Stefania Chaplin)

5 Lightning Solutions on the Nexus Platform (Stefania Chaplin)

The CI/CD Pipeline in the Age of Containers (Siamak Sadeghianfar and Curtis Yanko)

The CI/CD Pipeline in the Age of Containers (Siamak Sadeghianfar and Curtis Yanko)

Intuit: Red Teaming with Nexus (Shannon Lietz)

Intuit: Red Teaming with Nexus (Shannon Lietz)

CI/CD and Nexus at the NIH, National Cancer Institute (Sarah Elkins)

CI/CD and Nexus at the NIH, National Cancer Institute (Sarah Elkins)