API World + CloudX + Dev Innovation Summit 2024: Full Schedule

arrow_back View All Dates

10:30am PST

OPEN SESSION (CloudX): 5 Steps to VEX Success: Managing the End-to-End Workflow

Thursday November 7, 2024 10:30am - 10:55am PST

Cortez Frazier Jr., FOSSA, Principal Product Manager

If you work in vulnerability management or DevSecOps programs, you’re probably familiar with the painful condition known as CVE overload. Each year, tens of thousands of new vulnerabilities are reported, which causes stress and late nights for the teams tasked with remediating them.

And that’s not to mention the herculean tax of distinguishing between potential vulnerabilities and confirmed vulnerabilities. The reality that most vulnerabilities are only potentially exploitable (as determined by the deployed context of each package) also means remediation often results in a lot of wasted time and effort.

A proposed solution is VEX (Vulnerability Exploitability eXchange): a set of formats that communicates vulnerability impact status, whether a vulnerability is exploitable in its deployed context, and mitigation steps. In theory, VEX (when used alongside other prioritization inputs) makes it possible to remediate more efficiently. But as with most security frameworks, efficacy depends on proper implementation.

This talk will cover five steps to leveraging VEX throughout the vulnerability remediation lifecycle, from the time a vulnerability is disclosed to the time you publish and distribute a VEX statement. We’ll cover the tools and workflows teams need to know to effectively use VEX in their organizations.

Speakers

Cortez Frazier Jr.

Principal Product Manager, FOSSA

Cortez Frazier Jr. is the product lead for FOSSA’s SaaS and on-premises enterprise applications. FOSSA is a developer tool (in the software composition analysis category) for managing open source license compliance and security vulnerabilities.Before joining FOSSA, Cortez served... Read More →

Thursday November 7, 2024 10:30am - 10:55am PST
CloudX -- Main Stage

CloudX: DevOps Summit, DevSecOps

Talk Type OPEN Session
Track or Conference OPEN Session, CloudX, DevSecOps (CloudX), CI/CD (CloudX)
In-Person/Virtual In Person

2:00pm PST

PRO SESSION (CloudX): Building Robust Networks: The Power of CI/CD in Network Validation

Thursday November 7, 2024 2:00pm - 2:25pm PST

CloudX -- Stage 1

Naveen Achyuta, Roblox, Network Reliability Engineer

While CI/CD practices are well-established in software development, the networking field is still adapting to these methodologies. This presentation demonstrates a method for validating network configurations in a lab environment, both pre- and post-deployment, to build confidence before implementing changes in production networks. Using open-source tools, custom scripts, and containerlab, we'll walk through each step of implementing a CI/CD pipeline. This approach not only enhances confidence in network deployments but also bridges the gap between traditional networking practices and modern DevOps methodologies.

Speakers

Naveen Achyuta

Network Reliability Engineer, Roblox

Naveen works as a Network Reliability Engineer at Roblox and lives in the Bay Area. After graduating with his master's degree, he initially worked as a network engineer at Comcast. He then transitioned to network software engineering to build network automation systems that streamline... Read More →

Thursday November 7, 2024 2:00pm - 2:25pm PST
CloudX -- Stage 1

CloudX: DevOps Summit, CI/CD

Talk Type PRO Session
Track or Conference CloudX, CloudX: DevOps Summit, CI/CD (CloudX), Automated Testing & Monitoring & Reporting (CloudX)
In-Person/Virtual In Person