Software composition analysis (SCA) refers to obtaining insight into what open source components and dependencies are being used in your application. The process serves the purpose of assessing the security of these components and any potential risks or licensing conflicts brought forth by them.
Implementing SCA tools in your software development workflow correctly is an amazing step toward strengthening the security and integrity of the software supply chain.
What is more, open source software adoption has revolutionised application development and now independent developers and enterprises can use existing components and libraries in their code to implement functionalities from simple web form validations to complex cryptographic operations.
Reviewing a dozen components could be a simple task to perform manually, but modern software applications are built using hundreds of libraries. These libraries may themselves have other dependencies. This process can run many layers deep, and before you know it, your application that otherwise appears to contain just a handful of libraries, may be pulling in hundreds or thousands of transitive dependencies. Here comes SCA to the rescue.
Most SCA tools can generate a software bill of materials (SBOM). An ideal SBOM provides the component’s name, version number, date of release, checksum, license information among other metadata for every component present in your application.
This can be done in one of two ways:
- Manifest scanning: The SCA tool scans your application’s build manifest files, such as package.json, for JavaScript or pom.xml for Apache Maven (Java) projects and generates a list of dependencies therein.
- Binary scanning: The SCA tool scans your build artifacts and identifies the open source components via binary fingerprinting.
- Manifest and binary scanning: Some SCA solutions may opt for a hybrid approach: scanning both manifests and binaries scanning to arrive at highly accurate SBOMs.
Automated SCA tools can help teams to build and ship high-quality code and empower stakeholders with a proactive approach to risk management. When identifying security vulnerabilities and risks early in the software development process, SCA tools can enable software developers to select more secure components upfront seamlessly. This speeds up the development process by minimising the need for repeated security assessments.
If a component with known risks and vulnerabilities is absolutely necessary, development teams can make a judgment call when the component is first introduced and contemplate adopting potential workarounds.
The goal of the SCA process and tools doesn’t end at merely scanning your application sources and binaries to produce an SBOM. Research including a paper produced by the University of Central Florida, George Mason, and Georgia Tech have discovered that CVE advisories can often be inaccurate and contain inconsistencies. Other times CVE data can be misinterpreted due to how Common Platform Enumeration (CPE) data is presented in these advisories.
For instance, a CVE advisory issued for vulnerability in the Tomcat server may apply to only a select component under the Apache Tomcat namespace, such as org.apache.tomcat:coyote rather than the entire Apache Tomcat namespace.
