Open-Source Software (OSS) Risk Assessment with Najib

This session is designed for security engineers, developers, and compliance officers who want to assess and manage the risks of using open-source components in their applications.

We'll walk through:

-Identifying high-risk OSS components in your codebase
-Using SCA tools (e.g., BlackDuck, OWASP Dependency-Check) to assess CVEs and license issues
-Mapping OSS use to SBOM and compliance frameworks (e.g., ISO 5230, EU CRA)
-Prioritizing remediation based on exploitability, reachability, and business impact
-Creating governance policies for OSS adoption in CI/CD

You'll leave this session with a practical understanding of how to evaluate and manage open-source risk in real projects—whether for internal security, regulatory compliance, or customer assurance.