OWASP AppSec DC 2012/The Unfortunate Reality of Insecure Libraries

From OWASP
Jump to: navigation, search

Registration Now OPEN! | Hotel | Schedule | Convention Center | AppSecDC.org

The Presentation

Many organizations have started application security programs to focus on finding and subsequently preventing vulnerabilities in their custom code. However, the widespread use of common libraries introduces risks that are widely ignored and unappreciated. In this study, we analyze over 113 million library downloads from the Maven Central repository of the 31 most popular Java frameworks and security libraries by over 500,000 companies. The data show that there are a surprising amount of libraries with known vulnerabilities in common use. We also conclude that most organizations do not appear to have a strong process in place for ensuring that the libraries they rely on are up-to-date and free from known vulnerabilities.

The Speakers

Arshan Dabirsiaghi

Bio TBA

Jeff Williams

As a pioneer in the software development and security field, Jeff Williams is one of the world's foremost experts on application security. Williams is the co-founder and CEO of Aspect Security, a consulting firm focused exclusively on application security that supports a worldwide clientele with critical applications in the government, defense, financial, healthcare, services and retail sectors. Williams and his team at Aspect Security are founding members of the Open Web Application Security Project (OWASP), through which Williams has made industry contributions including: the OWASP Top Ten, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Risk Rating Methodology and WebGoat. Williams holds advanced degrees in psychology, computer science and human factors, and graduated cum laude from Georgetown Law.

Gold Sponsors

Silver Sponsors

Small Business

Exhibitors
{"cc_re__cc_re__cc_by_sa_4_0": ["i><li id=\"t-info\"><a href=\"/index.php?title=OWASP_AppSec_DC_2012/The_Unfortunate_Reality_of_Insecure_Libraries&amp;action=info\" title=\"More information about this page\">Page information</a></li>\t\t\t\t\t</ul>\n\t\t\t\t\t\t\t</div>\n\t\t</div>\n\t\t\t\t</div>\n\t\t</div>\n\t\t<div id=\"footer\" role=\"contentinfo\">\t            \n\t\t\t\t\t\t\t<ul id=\"footer-info\">\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-info-lastmod\"> This page was last modified on 25 March 2012, at 12:32.</li>\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-info-copyright\">Content is available under <a class=\"external\" rel=\"nofollow\" href=\"https://creativecommons.org/licenses/by-sa/4.0/\">Creative Commons Attribution-ShareAlike</a> unless otherwise noted.</li>\n\t\t\t\t\t\t\t\t\t</ul>\n\t\t\t\t\t\t\t<ul id=\"footer-places\">\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-places-privacy\"><a href=\"/index.php/OWASP:Privacy_policy\" title=\"OWASP:Privacy policy\">Privacy policy</a></li>\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-places-about\"><a href=\"/index.php/OWASP:About\" title=\"OWASP:About\">About OWASP</a></li>\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-places-disclaimer\"><a href=\"/index.php/OWASP:General_disclaimer\" title=\"OWASP:General disclaimer\">Discla", "\t\t\t<li id=\"footer-places-privacy\"><a href=\"/index.php/OWASP:Privacy_policy\" title=\"OWASP:Privacy policy\">Privacy policy</a></li>\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-places-about\"><a href=\"/index.php/OWASP:About\" title=\"OWASP:About\">About OWASP</a></li>\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-places-disclaimer\"><a href=\"/index.php/OWASP:General_disclaimer\" title=\"OWASP:General disclaimer\">Disclaimers</a></li>\n\t\t\t\t\t\t\t\t\t</ul>\n\t\t\t\t\t\t\t\t\t\t<ul id=\"footer-icons\" class=\"noprint\">\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-copyrightico\">\n\t\t\t\t\t\t\t<a href=\"https://creativecommons.org/licenses/by-sa/4.0/\"><img src=\"/resources/assets/licenses/cc-by-sa.png\" alt=\"Creative Commons Attribution-ShareAlike\" width=\"88\" height=\"31\"/></a>\t\t\t\t\t\t</li>\n\t\t\t\t\t\t\t\t\t\t\t<li id=\"footer-poweredbyico\">\n\t\t\t\t\t\t\t<a href=\"//www.mediawiki.org/\"><img src=\"/resources/assets/poweredby_mediawiki_88x31.png\" alt=\"Powered by MediaWiki\" srcset=\"/resources/assets/poweredby_mediawiki_132x47.png 1.5x, /resources/assets/poweredby_mediawiki_176x62.png 2x\" width=\"88\" height=\"31\"/></a>\t\t\t\t\t\t</li>\n\t\t\t\t\t\t\t\t\t</ul>\n\t\t\t                        "], "copyright__copyright__copyright": ["and his team at Aspect Security are founding members of the Open Web Application Security Project (OWASP), through which Williams has made industry contributions including: the OWASP Top Ten, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Risk Rating Methodology and WebGoat. Williams holds advanced degrees in psychology, computer science and human factors, and graduated cum laude from Georgetown Law.\n\nGold Sponsors\n\nSilver Sponsors\n\nSmall Business\n\nExhibitors", "and his team at Aspect Security are founding members of the Open Web Application Security Project (OWASP), through which Williams has made industry contributions including: the OWASP Top Ten, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Risk Rating Methodology and WebGoat. Williams holds advanced degrees in psychology, computer science and human factors, and graduated cum laude from Georgetown Law.\n\nGold Sponsors\n\nSilver Sponsors\n\nSmall Business\n\nExhibitors", "and his team at Aspect Security are founding members of the Open Web Application Security Project (OWASP), through which Williams has made industry contributions including: the OWASP Top Ten, Enterprise Security API (ESAPI), Application Security Verification Standard (ASVS), Risk Rating Methodology and WebGoat. Williams holds advanced degrees in psychology, computer science and human factors, and graduated cum laude from Georgetown Law.\n\nGold Sponsors\n\nSilver Sponsors\n\nSmall Business\n\nExhibitors"]}