How do you ensure web application dependencies are secure? (2024)

When scanning dependencies, it's beneficial to consider their "reachability." Often, dependencies such as those listed in a Go project's go.mod file may include unused or unreachable packages. Scanning these can be superfluous, generating unnecessary noise within a DevSecOps framework. For this purpose, CDXGEN, an open-source tool, which has usage-detection ability, can be utilized to streamline the process.

You can scan and get a list of dependencies easily if you use simple mechanisms like maven, gradle, yarn.lock, requirements.txt for Python, and others. In case you have a custom build, you may find yourself in a situation where using one mechanism will not cover all the dependencies of the whole project. In this case, you need to use different analysis tools and aggregate the result into a vulnerability management system. For example, gather JavaScript and Python dependencies with Syft, maven dependencies with cyclonedx-maven-plugin and generate a single report in Dependency Track.

The important to have visibility on all your dependencies and security weaknesses is to scan the dependencies as soon as they exist in the Software Development Life Cycle. However, the crucial metric to ensure the dependencies can have repeated scanning is to measure the mean time between two scanning reports, or in short the scan result should have an expiry.Another critical measure is the Coverity between dependencies that got scanned and the dependencies that existed in the source code, in all software repositories that we're protecting

It is good practice to store the update as an artifact in a secure perimeter from where it will be picked up by the software when it is built. It is important to run security tests and review the software's behaviour after the update to ensure that the update does not introduce new vulnerabilities or undeclared features. If no new vulnerabilities are detected, you can update and go into production.

This is an easy statement from a security standpoint. However, it's not an easy task for developers at all. So to uplift, you need to implement a dependency manager into your environment to help check and suggest the up-to-date version of dependency to the developers so that they can do their best - code review and make the next stepsHowever, OSS dependencies are community efforts and depend a lot on its maintainers. To prevent the situation where the dependency is not maintainable, support from maintainers and contributors. There is a necessary control to measure the dependencies to help with the answers: Are the dependencies secure and healthy enough to use, supported by active contributors and frequency release updates?

Programs like ESLint, Prettier, or PyLint belong to the linter class. That means that they check code quality rather than its safety. For safety checks, it is better to use SAST analysers. Among free ones you may try Semgrep. On Semgrep Playground there is a large choice of rules for different languages and frameworks.

You can use the free OWASP Dependency Track to track vulnerabilities in your dependencies. It allows you to get information about new vulnerabilities every day from NVD, Gihub and other databases.

A lot of unused and unnecessary dependencies can cause noise in dependencies vulnerability assessment and cost a lot of effort to remediate. The easiest way to help reduce is always to remove them as we don't need them. There are a few tools to help scan the source code to identify the dependencies imported but not in use to remove

You can use the free OWASP Dependency Track to get information about dependency licence terms.It is good practice to store the update as an artifact in a secure perimeter from where it will be picked up by the software when it is built. It is important to run security tests and review the behaviour of the software after the update to ensure that the update does not introduce new vulnerabilities or undeclared features.

Set up a measured approach and metrics to ensure we can effectively audit the dependencies periodically:How much time does it take for your dependencies can scan against the latest vulnerability database?Mechanism to ensure 100% dependencies within the code are inventoried and scanned?Mean time between two scan results?

Dependencies security management and Application Security is a team play efforts. And your teammate not only security guys but also developer guys. So the key to accelerating the program is to ensure we reduce the feedback loop as much as possible, and developer friendly so that we can focus on mitigation actionsTrying to measure everything in a data-driven approach so that we can identify where is the gaps and periodically improve the program