News and Notes from the makers of Nexus | Sonatype Blog

Open Source Attacks on the Rise: Top 8 Malicious Packages Found in npm

By Ax Sharma on June 08, 2021 featured

We're rounding up the top 8 malicious cyber attacks on npm that Sonatype has discovered with its next-gen open source security and malware detection tool.

Read More...

software supply chain attacks in the federal government

What is Dependency Confusion and Why Does it Matter in the Federal Sector?

By Jason Nalewak on May 14, 2021 government

Developers in the federal space are not immune from dependency confusion attacks. Following Biden's Cybersecurity Executive Order, understanding the attack vector is even more crucial

Read More...

Katie Arrington discusses making development move at the speed of relevance

By Ryan Schradin on September 14, 2020 government

Katie Arrington, CISO for the Office of the Under Secretary of Defense for Acquisition, recently discussed DevSecOps in the federal government and how the DoD is tackling key issues.

Read More...

NIST: Adopt a Secure Software Development Framework (SSDF) to Mitigate Risk of Software Vulnerabilities

By Jason Green on June 11, 2020 government open source software (GOSS)

NIST recommends a SSDF framework to assess open source component cybersecurity risks, including an SBOM and automated security controls in the SDLC.

Read More...

Six Memorable Sessions with Government DevSecOp Leaders: What We Learned

By Jason Green on May 07, 2020 Cybersecurity

Chris Roberts, Ron Ross, Katie Arrington, Nicolas Chaillan, and Lauren Knausenberger join Sonatype leadership to discuss security trends in the government.

Read More...

Federal DevSecOps Leaders: It's Time to Join The Conversation

By April Downey on April 10, 2020 government open source software (GOSS)

The DevSecOps Government Leadership Forum, typically hosted in Washington, D.C., will be hosted online so government leaders everywhere can participate.

Read More...

Department of Defense DevSecOps Journey

By Sylvia Fronczak on March 30, 2020 government

The DevSecOps stack is open source and open to the public. Everything is infrastructure as code and can run on any environment, leveraging Kubernetes.

Read More...

Top 6 Reasons the Time is Now for DevSecOps in the Federal Government

By Jason Green on March 25, 2020 Cybersecurity

By playing better offense at the beginning of the digital supply chain, federal agencies can better protect themselves and the American citizenry.

Read More...

Improving DevSecOps at the GSA

By Derek Weeks on September 05, 2019 government

The General Service Administration shares how it adopted devops practices interagency in this presentation, Getting There: The Journey to Government DevOps.

Read More...

Josh Corman on Keeping up with Hackers [CNBC VIDEO]

By Derek Weeks on August 11, 2015 blackhat

Josh Corman had a busy week at BlackHat last week. During the chaos, CNBC news caught up with him to talk about recent cyber attacks and what can be expected in the future.

Read More...

Software composition analysis

Nexus Lifecycle Add-on:

Artifact Repository

Container + INfrastructure Security

Nexus Lifecycle Add-on:

Pricing

For Professionals

For Industries

Content

Free Tools

Support

About us

Contact Us

Sonatype Blog

Open Source Attacks on the Rise: Top 8 Malicious Packages Found in npm

What is Dependency Confusion and Why Does it Matter in the Federal Sector?

Katie Arrington discusses making development move at the speed of relevance

NIST: Adopt a Secure Software Development Framework (SSDF) to Mitigate Risk of Software Vulnerabilities

Six Memorable Sessions with Government DevSecOp Leaders: What We Learned

Federal DevSecOps Leaders: It's Time to Join The Conversation

Department of Defense DevSecOps Journey

Top 6 Reasons the Time is Now for DevSecOps in the Federal Government

Improving DevSecOps at the GSA

Josh Corman on Keeping up with Hackers [CNBC VIDEO]

Products

Free Tools

Solutions

Resources

Company