Security | Threat Detection | Cyberattacks | DevSecOps | Compliance

Open Source


From diligence to integration: How software audits inform post-close M&A strategies

Software due diligence is an all-important aspect of any merger and acquisition (M&A) transaction, and in the tech M&A world, a target’s software assets are a significant part of the valuation. This due diligence process should identify a target company’s open source license obligations, application security and code quality risks, and the organization, processes, and practices that compose the software development life cycle.

Securing the Software Supply Chain: Key Findings From the Mend Open Source Risk Report

Open source vulnerabilities are in permanent growth mode. A significant quarterly increase in the number of malicious packages published in registries such as npm and rubygems have shown the increasing need to protect against this trending attack. At the same time, companies struggle to close the remediation gap on known vulnerable open source code. It’s all in The Mend Open Source Risk Report, which details these and other significant risks posed by the ongoing rise in open source vulnerabilities and software supply chain attacks.

Is Open Source Software Dead?

Open source software (OSS) has driven technological growth for decades due to its collaborative nature and ability to share information rapidly. However, major OSS security vulnerabilities like Log4j, Heartbleed, Shellshock and others have raised concerns about the security and sustainability of similar projects. At the same time, major open source-based companies have changed their OSS licenses, like MongoDB, Elastic (formerly ElasticSearch), Confluent, Redis Labs and most recently, HashiCorp.


To OSINT and Beyond!

Open-Source Intelligence (OSINT) can be valuable for an organization and penetration testing engagements in several ways. Today, let me highlight two areas: Leaked Credentials and Files. As part of any security engagement, it is ideal, if not essential, that we look up our target’s leaked credentials and files, as many clients do not have a high level of visibility or awareness in this area.


Open Source CyberSecurity Tools for Hardening

Open-source cybersecurity tools offer a prime solution for independent security experts, emerging businesses, and even medium to large enterprises aiming to tailor their security framework. These tools serve as a foundational platform for fostering security advancements, integrating proprietary software code and security automation scripts.


Tips and Tools for Open Source Compliance

You don’t need us to tell you that open source software is becoming a very significant percentage of commercial software codebases. Open source components are free, stable, and enable you to focus your resources on the innovative and differentiated aspects of your work. But as the use of open source components increases, compliance with open source licenses has become a complex project of growing importance. So how can you stay on top of compliance and what tools are out there to help?


We're open-sourcing the library that powers 1Password's ability to log in with a passkey

You may have heard that 1Password beta testers can sign into websites using passkeys stored in their vaults. We’re actively developing the internal library powering passkey authentication, and now we’re open-sourcing it!


Open Source Security for Hardening

Numerous inventive security solutions offered by open source software (OSS) remain untapped by the U.S. government. OSS refers to software for which the source code is accessible, allowing for its use, modification, and distribution. Dynamic OSS projects yield swift advancements and promote inclusive development, rendering them more adaptable to specialized demands. In cases where adjustments are necessary, the code can be accessed and modified accordingly.

Managing Internal Dependencies with Black Duck: New Custom Component Capability | Synopsys

Discover the latest capabilities in Black Duck for efficient custom component management and handling internal dependencies. This video provides insights into the automatic identification of new custom components within Black Duck, enhancing its existing capabilities for open source and internal dependency management. Learn how to navigate… unknown components create custom components and seamlessly integrate them into your projects.