{"id":92519,"date":"2020-08-28T07:42:26","date_gmt":"2020-08-28T05:42:26","guid":{"rendered":"https:\/\/prohoster.info\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya"},"modified":"2020-08-28T07:42:26","modified_gmt":"2020-08-28T05:42:26","slug":"devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/administrirovanie\/devsecops-princzipy-raboty-i-sravnenie-sca-chast-pervaya","title":{"rendered":"DevSecOps: principles of operation and comparison of SCA. Part one","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"

The significance of Software Composition Analysis (SCA) in the development process is increasing as annual reports on vulnerabilities in open source libraries are published by companies like Synopsys, Sonatype, Snyk, and White Source. According to the report The State of Open Source Security Vulnerabilities 2020<\/a><\/noindex> the number of identified vulnerabilities in open source in 2019 increased by almost 1.5 times compared to the previous year, while components with open source are used in 60% to 80% of projects. According to independent opinion, SCA processes are a separate practice of OWASP SAMM and BSIMM as a maturity indicator, and in the first half of 2020, OWASP released the new OWASP Software Component Verification Standard (SCVS), providing best practices for verifying third-party components in the software supply chain.<\/p>\n

\"DevSecOps:
\n<\/a><\/noindex>
\nOne of the most telling cases occurred<\/a><\/noindex> with Equifax in May 2017. Unknown attackers obtained information about 143 million Americans, including full names, addresses, social security numbers, and driver's license numbers. In 209,000 cases, documents also contained information about the victims' credit cards. This breach occurred due to the exploitation of a critical vulnerability in Apache Struts 2 (CVE-2017-5638), even though a fix had been released back in March 2017. The company had two months to implement the update, but no one addressed this issue.<\/p>\n

This article will discuss the selection of a tool for conducting SCA from the perspective of analysis quality. A functional comparison of the tools will also be provided. The process of integration into CI\/CD and integration capabilities will be left for future publications. A wide list of tools was presented by OWASP on its website<\/a><\/noindex>, but in this overview, we will only touch upon the most popular open source tool Dependency Check, the slightly less well-known open source platform Dependency Track, and the enterprise solution Sonatype Nexus IQ. We will also examine how these solutions work and compare the results regarding false positives.<\/p>\n

\"DevSecOps:
\n<\/p>\n

Operating principle<\/h3>\n

\nDependency Check<\/a><\/noindex> is a utility (CLI, maven, jenkins module, ant) that analyzes project files, gathering pieces of information about dependencies (package name, groupid, specification title, version\u2026), constructs a CPE string (Common Platform Enumeration), Package URL (PURL) and identifies vulnerabilities for CPE\/PURL from databases (NVD, Sonatype OSS Index, NPM Audit API\u2026), after which it generates a one-time report in HTML, JSON, XML formats...<\/p>\n

Let's see what a CPE looks like:<\/p>\n

cpe:2.3:part:vendor:product:version:update:edition:language:sw_edition:target_sw:target_hw:other<\/code><\/pre>\n
<\/p>\n