Lessons from OpenSSL vulnerabilities part 1: Preparing your supply chain for the next critical vulnerability

You should be prepared to check your physical hosts, virtual machines, cloud instances, container images, and source code for vulnerable libraries, as well as considering the software dependency trees of your applications and potentially even including OpenSSL libraries directly in your application builds. This includes taking into account ephemeral and dynamic workloads, such as those running on containers or serverless platforms, where vulnerabilities can be present in hundreds or thousands of images. You should also consider using tools like Snyk to monitor your software supply chain for vulnerabilities and provide fix advice for fast resolutions.