# Shift Security Practices Left.

# All the Way Left.

## Winners innovate, Losers don’t.

**The best and the brightest use precise open source component intelligence early, everywhere, and at scale.**

## Here’s why.

##### Open source component usage is massive and it’s growing.

#### 7,000 & 70,000 500 billion

number of new projects and download requests of Java, open source components (versions) npm, PyPI, and RubyGems released every week, respectively. were recorded in 2018.

#### 300,000+ 85%

open source components are of the components in downloaded annually by the most modern applications average company. are open source.

## It must be managed.

##### The best organizations manage component sourcing through repository managers. The rest employ free-for-all methods.

### THOUSANDS

#### 30,000 → 180,000

growth in the number of active instances of <u>Nexus Repository</u> in the last 5 years.

## It must be secure.

##### How do the best organizations harness all the good and none of the bad?

#### 1 in 10 40% 23,000

|open source component|of organizations are increasing their|organizations use RHC daily to|
|---|---|---|
|downloads contain a known|level of component analysis using|measure the 58 million components|
|security vulnerability.|Repository Health Check (RHC).|living inside local repositories.|

## It must be automated.

**According to Gartner:**

- **By 2019, more than 70% of enterprise DevOps initiatives will have incorporated automated security vulnerability and configuration scanning** **for open source components.**
- **Implementing an ‘OSS firewall’ proactively prevents developers from downloading known vulnerable code.**

## Build quality in from the start.

##### Create value early in the development process by automatically blocking defective components.

proxy repo staging repo production

quarantine

**Easily identify good components from bad components and block the bad ones from entering your Nexus or Artifactory** **Repository through customized policies.**

## Learn more

- **Watch the videos:** <u>Nexus Firewall for RubyGems</u> **and**

|Nexus Firewall for Artifactory.||
|---|---|
|•|Read the Blog: Nexus Firewall Now Supports Artifactory Customers.|
|•|Take a tour of Nexus Firewall.