# Shift Security Practices Left. All the way Left.

## Winners innovate, Losers don’t:

**The best and the brightest use precise open source component intelligence early, everywhere, and at scale.**

## Here’s why:

##### Open source component usage is massive and it’s growing.

**7,000 new projects and 70,000 Over 100 billion download** open source components requests of Java, npm, PyPI, (versions) are released every week and RubyGems in 2018

**80%**  
**200,000 + 80%** components downloaded by an of an application is made up average company annually of open source components

## It must be managed.

##### The best organizations manage component sourcing through repository managers. The rest employ free-for-all-methods.

### THOUSAND

**30,000 → 180,000** growth in the number of active instances of **Nexus Repository** in the last 5 years.

## It must be secure.

##### How do the best organizations harness all the good and none of the bad?

**1 in 16 40% 23,000**

| open source component | of organizations are increasing | organizations use RHC daily to |  |
|---|---|---|---|
| downloads contain a known | their level of component | measure the 58 million |  |
| security vulnerability | analysis using Repository Health Check (RHC) | components living inside local | repositories |

## It must be automated.

##### According to Gartner:

- By 2019, more than **70% of enterprise DevOps initiatives will have** **incorporated automated security vulnerability** and configuration scanning for open source components
- “Implement an **‘OSS firewall’ to proactively prevent developers from** **downloading known vulnerable code.**”

## Build quality in from the start.

Create value early in the development process **by automatically blocking** **defective components.**

#### Nexus Firewall

quarantine area proxy repo staging repo production

##### Easily identify good components from bad components and block the bad

##### ones from entering your Nexus or Artifactory repository through customized policies.

## Learn more

- Watch the videos: <u>Nexus Firewall for RubyGems</u> and <u>Nexus Firewall for</u>

| Artifactory ||
|---|---|
| • | Read the Blog-Nexus Firewall Now Supports Artifactory Customers |
| • | Take a tour of Nexus Firewall |