fermer
fermer
Le réseau de demain
Le réseau de demain
Planifiez votre chemin vers un réseau plus rapide, plus sûr et plus résilient, conçu pour les applications et les utilisateurs que vous prenez en charge.
          Essayez Netskope
          Get Hands-on With the Netskope Platform
          Here's your chance to experience the Netskope One single-cloud platform first-hand. Sign up for self-paced, hands-on labs, join us for monthly live product demos, take a free test drive of Netskope Private Access, or join us for a live, instructor-led workshops.
            Un leader sur SSE. Désormais leader en matière de SASE à fournisseur unique.
            Un leader sur SSE. Désormais leader en matière de SASE à fournisseur unique.
            Netskope fait ses débuts en tant que leader dans le Magic Quadrant™ de Gartner® pour le SASE à fournisseur unique.
              Sécuriser l’IA générative pour les nuls
              Sécuriser l’IA générative pour les nuls
              Learn how your organization can balance the innovative potential of generative AI with robust data security practices.
                Modern data loss prevention (DLP) for Dummies eBook
                La prévention moderne des pertes de données (DLP) pour les Nuls
                Get tips and tricks for transitioning to a cloud-delivered DLP.
                  Réseau SD-WAN moderne avec SASE pour les nuls
                  Modern SD-WAN for SASE Dummies
                  Cessez de rattraper votre retard en matière d'architecture de réseau
                    Identification des risques
                    Advanced Analytics transforms the way security operations teams apply data-driven insights to implement better policies. With Advanced Analytics, you can identify trends, zero in on areas of concern and use the data to take action.
                        Les 6 cas d'utilisation les plus convaincants pour le remplacement complet des anciens VPN
                        Les 6 cas d'utilisation les plus convaincants pour le remplacement complet des anciens VPN
                        Netskope One Private Access is the only solution that allows you to retire your VPN for good.
                          Colgate-Palmolive protège sa "propriété intellectuelle" "grâce à une protection des données intelligente et adaptable
                          Colgate-Palmolive protège sa "propriété intellectuelle" "grâce à une protection des données intelligente et adaptable
                            Netskope GovCloud
                            Netskope obtient l'autorisation FedRAMP High Authorization
                            Choisissez Netskope GovCloud pour accélérer la transformation de votre agence.
                              Let's Do Great Things Together
                              La stratégie de commercialisation de Netskope privilégie ses partenaires, ce qui leur permet de maximiser leur croissance et leur rentabilité, tout en transformant la sécurité des entreprises.
                                Solutions Netskope
                                Netskope Cloud Exchange
                                Netskope Cloud Exchange (CE) provides customers with powerful integration tools to leverage investments across their security posture.
                                  Support technique de Netskope
                                  Support technique de Netskope
                                  Nos ingénieurs d'assistance qualifiés sont répartis dans le monde entier et possèdent des expériences diverses dans les domaines de la sécurité du cloud, des réseaux, de la virtualisation, de la diffusion de contenu et du développement de logiciels, afin de garantir une assistance technique rapide et de qualité
                                    Vidéo Netskope
                                    Formation Netskope
                                    Grâce à Netskope, devenez un expert de la sécurité du cloud. Nous sommes là pour vous aider à achever votre transformation digitale en toute sécurité, pour que vous puissiez profiter pleinement de vos applications cloud, Web et privées.

                                      An Inside Look at How to Keep Open Source Software Dependencies Up-to-Date and Secure

                                      Aug 03 2022

                                      Today, open source software provides the foundation for the vast majority of applications across all industries, and software development has slowly moved toward software assembling. Because of this change in the way we deliver the software, new attack surfaces have evolved and software security is facing new challenges inherent with dependency on open source software. A few examples of open source vulnerabilities which had a severe impact are Log4j and the SolarWinds Supply Chain Attack, among many others.

                                      As per the Synopsys Open Source Security and Risk Analysis” (OSSRA) 2021 report, 84% of open source codebases have had at least one vulnerability with an average of 158 vulnerabilities per codebase.

                                      Graph showing software supply chain attack trends
                                      Software supply chain attacks trends

                                      How the Netskope team addresses this

                                      The Netskope Internal Security team utilizes Github Dependabot as one of the solutions to address the dependency problem. Dependabot keeps your dependencies up-to-date by informing you of any security vulnerabilities in your dependencies, and automatically opens pull requests to upgrade your dependencies to the next available secure version when a Dependabot alert is triggered, or to the latest version when a release is published.

                                      Naturally, Dependabot aligns with the Netskope principle of embedding security in the developer workflow and being part of the developer experience by providing security-as-a-self-service.

                                      Graph showing the effectiveness of Dependabot
                                      Effectiveness of Dependabot

                                      Pull request monitoring automation framework

                                      At Netskope, my team took a further step to embed security in the developer experience and developed an automation framework, called sec-depend-aider, to monitor the pull requests created by Dependabot and feed it back to Jira into the right team’s bucket, where developers can triage and remediate it holistically along with other areas of work. 

                                      Additionally, the automation framework enables the Dependabot security alerts for all unarchived repos, if not enabled already.

                                      We are happy to make the automation framework publicly available to align with another Netskope principle of giving back to the community, dutifully. 

                                      You can access our Open Source Automation Framework here. Here’s some additional detail around how this automation works, as well as best practices to consider when using sec-depend-aider:

                                      Diagram showing automation architecture and workflow
                                      Automation architecture and workflow

                                      Key points

                                      • As depicted in the above architecture, the automation framework queries the GitHub REST and GraphQL API to fetch the information for pull request driven by the search query below
                                      • The automation relies on a custom configuration file to fetch the required information to generate tickets to Jira. We understand that this configuration will vary depending on your use-case, hence we are providing that part as a sample code and configuration. Feel free to change according to your environment.
                                      • Priority of the Jira ticket is driven by the Severity of Dependabot Alerts (parameter DEPENDABOT_JIRA_SEVERITY).
                                      • We are using Jenkins as a solution to run it periodically so that we can reutilize the existing communication integrations, though it will work just fine even with a cron job.
                                      • PoC Jira integration code demonstrates how an end-to-end process can be automated with custom configuration of varying needs.
                                      • The automation has a waiting period, governed by the “WAITING_PERIOD” parameter; only after that timeframe pull requests will be considered for further actions like Jira ticket creation.
                                      • In the end, the output is pretty-printed in table format, along with Jira tickets as actionable deliverables.

                                      How you can use it

                                      • Create a repo to define the custom configuration (filename as custom-config.json in root directory of repo)
                                      • Update parameter DEPENDABOT_JIRA_SEVERITY to reflect your Jira severity definition
                                      • Set environment variables:
                                        • GITHUB_ACCESS_TOKEN
                                        • JIRA_SERVER
                                        • JIRA_API_USERNAME
                                        • JIRA_API_TOKEN

                                      Future work

                                      • Integrate the automation with GitHub Action to either:
                                        • Run from a centralized repository across the organization in a scheduled manner.
                                        • Run from each repository with events like pull request creation or push to a branch.
                                      • We started the automation by defining a sink as Jira, but it can be easily reused for any technology, for example feeding the data into a SIEM for analytics. 
                                      • We are already working on expanding the search query used in the automation to gather more datasets like GitHub Code and Secret Scanning Alerts.

                                      For more information about this automation for sec-depend-aider, please reach out to [email protected] or open an issue from here.

                                      author image
                                      Pramod Rana
                                      Pramod Rana is leading the Netskope application security team with a focus on integrating security controls in the SDLC and security testing of Netskope product suite.
                                      Pramod Rana is leading the Netskope application security team with a focus on integrating security controls in the SDLC and security testing of Netskope product suite.

                                      Restez informé !

                                      Abonnez-vous pour recevoir les dernières nouvelles du blog de Netskope