WhiteSource

Whitesource is an open source security and license compliance management platform. It was founded in 2011 by Ron Rymon, Azi Cohen, and Rami Sass.

History

The company was founded after its three co-founders sold their previous company, Eurekify, to CA Technologies. During the due diligence process, the co-founders experienced first hand the challenge in generating an accurate open source inventory report.

Versions:

• 20.1.2
• 20.1.1
• 19.11.2 Easier Onboarding for JFrog Artifactory Docker Integration
• 19.9.1
  • GitLab Core beta version, enabling GitLab users to access WhiteSource security alerts within GitLab’s native environment
• 18.12.1

Overview

The company launched its open source license management platform. The software discovers open source components in the customers’ apps. It then alerts them when a vulnerable code is added to the software projects that are being used or when threats pop up that affect the existing software.

WhiteSource provides an open source security and license compliance management platform for organizations to manage their open source assets:

Detection

Automatically identifies all the open source components and dependencies in your build by constant and automatic cross-referencing of your open source components against WhiteSource’s definitive database of open source repositories.

Selection

While you search for open source components, our browser plugin reveals any reported bugs, security risks, undesirable licenses (as defined by the company policy you set up) newer versions and more for each component. WhiteSource has the ability to prioritize vulnerabilities by performing static scans to understand if the vulnerable part of a component is being directly called by the application

Alerting

The earlier you detect an issue the easier and less expensive it is to fix. Find out about potential pitfalls in your open source components and their dependencies before they turn into problems with optional security, policy, bug, and newer version email alerts. Each indicates level of severity, from high to low.

Reporting

Because WhiteSource continually and automatically logs a detailed inventory of your open source components, dependencies, licenses and license references, 100% accurate, up-to-date reports are always just a click away, and can be downloaded to spreadsheets in seconds.

Funding

Main investors in the company include Susquehanna Growth Equity, 83North, Microsoft Ventures, David Strohm and the Israeli Innovation Authority. The company has raised $46 million as of 2018.

Product

WhiteSource Bolt was launched in 2016 . and since December 2018 is available free for GitHub and Azure DevOps users capable of providing coverage for both binaries and source libraries.

External links

• WhiteSource Blog

Plugins

• TeamCity Plugin: https://whitesource.atlassian.net/wiki/spaces/WD/pages/33914926/TeamCity+Plugin

Related terms

• WhiteSource Core
• WhiteSource for Containers
• WhiteSource for developers , integrated with GitLab
• WhiteSource Prioritize
• WhiteSource Remediate
• WhiteSource DevOps Azure Extension

See also

• Software Composition Analysis (SCA): Flexera, FOSSA, GitLab Ultimate, JFrog Xray, Snyk, Sonatype, Synopsys: Black Duck, Veracode, WhiteHat Security, WhiteSource, Bill of Materials (BOM), Semgrep, Clair
• AppSec
• WhiteSource (SCA): WhiteSource Core, Unified Agent, Renovate, WhiteSource Server release notes
• Security: Security portfolio, Security standards, Hardening, CVE, CWE, Wireless Network Hacking, vulnerability scanner, Security risk assessment, SCA, Application Security Testing, OWASP, Data leak, NIST, SANS, MITRE, Security policy, Access Control attacks, password policy, password cracking, Password manager, MFA, OTP, UTF, Firewall, DoS, Software bugs, MITM, Certified Ethical Hacker (CEH) Contents, Security+ Malware, FIPS, DLP, Network Access Control (NAC), VAPT, SIEM, EDR, SOC, pentest, PTaaS, Clickjacking, MobSF, Janus vulnerability, Back Orifice, Backdoor, CSO, CSPM, PoLP, forensic, encryption, Keylogger, Pwn2Own, CISO, Prototype pollution

Text is available under the Creative Commons Attribution-ShareAlike License; additional terms may apply. By using this site, you agree to the Terms of Use and Privacy Policy.. Source: wikipedia