Chapter 44. Modern Approach to Software Composition Analysis: Call Graph and Runtime SCA
Aruneesh Salhotra
Since the early 2000s, the industry has seen a rapid expansion in open source adoption. Embracing open source is a strategic decision for cost savings and innovation toward a more collaborative, flexible, and high-quality software development paradigm.
Handling dependencies in software development is crucial and intricate. Developers commonly use external libraries and packages to improve and speed up their work, which can unintentionally lead to security weaknesses and operational dangers in their code. Secure and verify these external elements to keep a strong and safe software environment. A quick online search on “open source risks exploited at Yahoo, Equifax, Linksys, Uber” highlights the significance of meticulously managing the risks tied to open source libraries in your organizations.
SCA tools are designed to integrate seamlessly into development workflows, providing real-time analysis, automated alerts, and remediation guidance.
Traditional Approach to SCA
SCA tools scan applications statically by analyzing dependency manifest files to identify vulnerabilities associated with the included packages. They enable organizations to respond swiftly to emerging vulnerabilities in open source projects and ensure adherence to legal requirements in software licensing. ...
Get 97 Things Every Application Security Professional Should Know now with the O’Reilly learning platform.
O’Reilly members experience books, live events, courses curated by job role, and more from O’Reilly and nearly 200 top publishers.
