SBN

Activate Your Shield Against Open Source Invasions

What are infinity stones, and where are they located in the Nexus platform?

DevOps Connect:DevSecOps @ RSAC 2022

Mike Van Doren, Sonatype Solution Architect, has some ideas. He’s a fan of the Avengers, a Marvel comic universe where infinity stones grant superpowers. He explains the connection in his Nexus User Conference presentation, OSS Endgame: Nexus Firewall as Your Shield Against Open Source Invasions.

Nexus Firewall helps all of our customers on a regular basis,” says Mike. “It shields them from open source challenges and from bringing in software components with vulnerabilities.”

Expanding Your Superpowers

He continues, explaining through the lens of superpowers infinity stones are said to control:

  • Space – Nexus Firewall expands your universe of pipeline protection.

Example: Firewall connects with many popular tools. This gives you a comprehensive view of your software supply chain. We can layer JFrog’s Artifactory into Firewall, connect it to Nexus IQ, and protect you from all angles.

  • Reality – Nexus Firewall helps you understand all elements of your repository’s health, offering ongoing feedback for ultimate control.

    Example: Firewall runs regular audit reports. Use it to take unwanted components out of distribution, automatically.

  • Power – Nexus Firewall allows you to quickly quarantines policy violating components. This grants you power over adversaries who wish to cause trouble.

    Example: Firewall automatically moves questionable components into quarantine, before they can do harm. Gartner research predicts that 99% of future attacks will come from a known vulnerability by 2020. Policy automation is key.

  • Mind – Nexus Firewall allows you to leverage the minds of 65 world-class data researchers, allowing you to “automate faster than evil.”

Example: Nexus Firewall goes beyond the NVD data. Instead, Sonatype hashes (fingerprints) every individual component. Sonatype has identified 1.5 million unique vulnerabilities, and adds more daily. (An example is the (Read more...)

*** This is a Security Bloggers Network syndicated blog from Sonatype Blog authored by Katie McCaskey. Read the original post at: https://blog.sonatype.com/activate-your-shield-against-open-source-invasions