Leveraging Black Duck Hub to Maximize Focus - Entersekt’s Approach to Empowering Development Teams

Learn how fast-growing authentication and mobile security solutions provider Entersekt leverages Black Duck Hub for competitive advantage by empowering teams and automating open source security risk management throughout the Software Development Lifecycle (SDLC).

1. Leveraging Black Duck Hub to maximize focus Entersekt’s approach to empowering development teams By Philip Botha

2. Introduce myself ( 3 min ) Introduce Entersekt market, solutions & architectural overview ( 10 min ) Why and how we selected Black Duck ( 7 min ) Lessons Learned ( 7 min) Empowering teams (10 min) A winning team ( 3 min ) Q&A (10 min) **50min Outline

3. Making the online world safer

4. From the Windy City …

5. … to the Cape Winelands

6. Phishing attacks cost global organizations billions every year One out of 5 fraudulent transactions originate in the mobile channel More than 90% of mobile apps contain basic vulnerabilities Our problem: A global authentication pandemic LinkedIn suffers data breach NEWS Zeus Botnet Eurograbber Steals $47 Million Don’t bank on your phone – it could be hacked by Zeus ‘ trojan horse’ New vulnerabilities reported on a weekly basis Successful attacks not even making headlines anymore

7. Founded in 2008 by 5 engineering students One of the founders’ mother defrauded They wanted to do something that matters Not daunted by current failings of security solutions A novel approach with existing tech A solution: Entersekt’s story

8. Going live in 2012: Nedbank as a case study Entersekt go-live Nedbank does not even appear on SARS e-filing phishing site!!

9. A growing global footprint Johannesburg Mauritius Atlanta Beirut Dubai Lagos Minneapolis Sydney Amsterdam Cape Town Zurich Palo Alto

10. How we solved the problem

11. The 4 pillars of the Entersekt approach

12. How phishing defeats the one time password

13. Out of band authentication beats phishing

14. Product: The Transakt model

15. Gartner prediction about Entersekt tech

16. How Black Duck Hub makes us better

17. Risk management Approved open source? How secure? Can we be diligent and agile? Ability to identify open source licenses Scaling Manual vulnerability assessment process Getting behind with updates Our open source challenges

18. “Black Duck met Entersekt’s checklist of what we needed in an open source vulnerability management solution better than any other vendor .” The obvious choice was ...

19. Seamless integration and ease of use Relevant feedback Earlier in the SDLC Real-time and continuous monitoring Automated notifications Black Duck Hub checks the boxes

20. Easy-to-digest reports with minimal false positives Jenkins support and secure scanning Code doesn’t leave intranet Identify open source licenses Black Duck Hub checks the boxes (cont.)

21. Getting the best out of the Hub

22. Urgent vs important Build pipeline challenges Jenkins jobs differ in each team/project Black Duck sometimes executed manually No best practice/standard Maintenance owner Lessons learned

23. Empowering the development teams

24. Empowering the development teams (cont.) Architect Evangelist Security Evangelist Toolsmith

25. Phased roll-out in teams Phase 1: Education Phase 2: Implement a standard pipeline framework Phase 3: Hardening cycle Phase 4: Policy Management and Jira integration Team agreements Empowering the development teams (cont.)

26. CI/CD BUILD Tool: Docker/Maven DEPLOY DEV QA INT LT Tool: Docker TEST J Unit Automated Tool: Docker Release? RELEASE PROD Release repos COMMIT Tool: Git OS SECURITY Tool: Black Duck Hub STATIC CODE ANALYSIS Tool: Sonar Q ube Pull Request Merge Master

27. Pipeline framework template BUILD Tool: Docker/Maven DEPLOY DEV QA INT LT Tool: Docker TEST J Unit Automated Tool: Docker Release? RELEASE PROD Release repos COMMIT Tool: Git OS SECURITY Tool: Black Duck Hub STATIC CODE ANALYSIS Tool: Sonar Q ube Pull Request Merge Master

28. Pipeline framework template (cont.)

29. A winning team

30. Trust Support Ownership Clarity A tool is only as good as the team