Software composition analysis: how it identifies the risks associated with open source software



Credit: Elle Aon / Shutterstock

Software Composition Analysis (SCA) refers to getting an overview of the open source components and dependencies used in your application and how, all in an automated fashion.

This process is used to assess the security of these components and any potential risk or license conflict that may arise from them.

The correct integration of SCA tools into your software development workflow is an important step towards strengthening the security and integrity of the software supply chain by ensuring that no borrowed code introduces security risks or risks. legal compliance issues in your products.

Why software composition analysis is necessary

Gone are the days when software applications were built from scratch. The widespread adoption of open source software has revolutionized application development. Independent developers and businesses can use existing components and libraries in their code to implement functionality ranging from simple web form validations to complex cryptographic operations.

While re-using open source code has largely eliminated the need to reinvent the wheel, it comes with a few caveats: What if the code you’re borrowing has bugs or security holes? Additionally, what if the license terms carried by the open source component conflict with the license for your application? Who should review all of this?

Examining a dozen components can be a simple task to do manually, but modern software applications are built using hundreds of libraries. These libraries may themselves have other dependencies. This process can run many layers deep, and before you know it, your application that otherwise appears to have only a handful of libraries, can pull hundreds or thousands of transitive dependencies. This is where SCA comes to the rescue.

Analysis of software composition and SBOM

Most SCA tools can generate a software bill of materials (SBOM). An SBOM is a detailed account of the inventory, all of the dependencies and components that make up your application. An ideal SBOM provides the component name, version number, release date, checksum, license information among other metadata for each component present in your application.

This can be done in one of two ways:

  1. Manifest analysis: The SCA tool scans your application’s build manifest files, such as package.json, for JavaScript or pom.xml for Apache Maven (Java) projects and generates a list of dependencies inside. This approach works when developers analyze applications without the final version artifacts contained in or from a version control system (for example, GitHub, GitLab, or SVN).
  2. Binary analysis: The SCA tool analyzes your build artifacts and identifies open source components through a binary fingerprint. This process identifies all of the packages included in the final version of your app, which reduces false positives and captures third-party software and libraries added to your app in non-standard ways. Not all SCA tools have binary analysis capabilities.
  3. Manifest and binary analysis: Some SCA solutions may take a hybrid approach: parsing both manifests and binaries to get very accurate SBOMs. Therefore, the sophistication of your SCA solution determines how accurately it can identify all the hidden components in your application.

How do SCA tools help find open source vulnerabilities?

Automated SCA tools can help software teams create and deliver high-quality code and give stakeholders a proactive approach to risk management. By identifying vulnerabilities and security risks early in the software development process, SCA tools can enable software developers to select more secure components up front in a transparent manner.

This advantage speeds up the development process by minimizing the need for repeated security assessments, as sufficient care is taken early on when including third-party components and libraries in an application.

If a component with known risks and vulnerabilities is absolutely necessary, development teams can make judgment when first introducing the component and consider adopting potential workarounds to use the component safely.

The goal of the SCA process and tools goes beyond simply analyzing your application’s sources and binaries to produce an SBOM. The main challenge is to accurately map each version of the component to known vulnerabilities. Next comes the compliance aspect: let stakeholders transparently review and resolve any licensing conflicts posed by components.

Maybe a few years ago the process was straightforward. It would have been enough to go through the CVE streams provided by MITER or NVD and map them to the versions of the components present in your application.

Research including an article produced by the University of Central Florida, George Mason and Georgia Tech has shown that CVE advisories can often be inaccurate and contain inconsistencies. Other times, CVE data can be misinterpreted due to the way Common Platform Enumeration (CPE) data is presented in these notices.

For example, a CVE advisory issued for a vulnerability in the Tomcat server might apply only to a component selected under the Apache Tomcat namespace, such as org.apache.tomcat: coyote rather than the entire ‘Apache Tomcat namespace, but that may not be clear on its own. of the CPEs mentioned in the notice.

Read more on the next page …

Subscribe to the newsletter !

Error: Please verify your email address.

Free software tags



Comments are closed.