Open Source Summit Europe 2022

In today’s software ecosystem, the inclusion of dependencies in applications is practically a given. Including dependencies has clear benefits in terms of team velocity and business value, but it's also packaged (pun intended) with risks - most notably security-related ones. It is often suggested that "shifting left" is the best method to combat security risks such as vulnerabilities in dependencies, but this only catches vulnerabilities that have already been introduced. Implementing measures and best practices to prevent them from entering your application in the first place would be a more holistic approach. It is true that not all vulnerabilities can be prevented, but the latest research shows that the vast majority of publicly disclosed vulnerabilities can be. In this presentation, you’ll learn about best practices for managing your dependencies and how to reap their benefits in your applications, without compromising on security or velocity.