Software Integrity Blog

Archive for the 'Software Composition Analysis (SCA)' Category

 

The hidden costs and risks of free puppies (and open source)

SCA tools are an essential part of your AppSec toolkit, because free and open source software—just like free puppies—comes with hidden costs and risks.

Continue Reading...

Posted in Agile, CI/CD & DevOps, Open Source Security, Software Composition Analysis (SCA) | Comments Off on The hidden costs and risks of free puppies (and open source)

 

Hacking Security Episode 3: OSSRA report findings

Hacking Security is a monthly podcast on emerging trends in application security. Episode 3 explores key findings from the 2018 OSSRA report.

Continue Reading...

Posted in Mergers & Acquisitions, Open Source Security, Software Composition Analysis (SCA) | Comments Off on Hacking Security Episode 3: OSSRA report findings

 

Eating our own duck food: Software composition analysis in the Synopsys SDLC

In the Synopsys Software Integrity Group, we test all our products against one another—turning our security into a force multiplier for our customers’ security.

Continue Reading...

Posted in Software Composition Analysis (SCA) | Comments Off on Eating our own duck food: Software composition analysis in the Synopsys SDLC

 

NPM dependencies, supply chain attacks, and Bitcoin wallets

The EventStream incident shows just how easily attackers can infiltrate the open source software supply chain by adding a malicious dependency to a trusted component.

Continue Reading...

Posted in Open Source Security, Software Composition Analysis (SCA) | Comments Off on NPM dependencies, supply chain attacks, and Bitcoin wallets

 

CVE-2018-11776 and why you need Black Duck Security Advisories

Our researchers discovered 23 more versions of Struts vulnerable to CVE-2018-11776. The NVD won’t tell you that—but Black Duck Security Advisories will.

Continue Reading...

Posted in Open Source Security, Software Composition Analysis (SCA) | Comments Off on CVE-2018-11776 and why you need Black Duck Security Advisories

 

Open source security risk: Managing the threat in mergers and acquisitions

The prevalence of open source is a potential M&A risk, as buyers are often not aware that more than 50% of the code they acquire is made up of open source.

Continue Reading...

Posted in Mergers & Acquisitions, Open Source Security, Software Composition Analysis (SCA) | Comments Off on Open source security risk: Managing the threat in mergers and acquisitions

 

Securing containers at scale

Open source is the foundation of most modern applications. However, left untracked, open source can put containerized applications at risk of known vulnerabilities such as Heartbleed and CVE-2017-5638 found in Apache Struts.

Continue Reading...

Posted in Container Security, Open Source Security, Software Composition Analysis (SCA) | Comments Off on Securing containers at scale

 

The intersection between IAST and SCA and why you need both in your security toolkit

Interactive application security testing (IAST) and software composition analysis (SCA) are both powerful technologies for your software security program.

Continue Reading...

Posted in Agile, CI/CD & DevOps, Interactive Application Security Testing (IAST), Software Composition Analysis (SCA) | Comments Off on The intersection between IAST and SCA and why you need both in your security toolkit

 

CVE-2018-11776: The latest Apache Struts vulnerability

CVE-2018-11776, a newly disclosed critical remote code execution vulnerability, affects all supported versions of Apache Struts 2 web application framework.

Continue Reading...

Posted in Open Source Security, Software Composition Analysis (SCA) | Comments Off on CVE-2018-11776: The latest Apache Struts vulnerability

 

Lock the vote, ‘Spamalot’ returns, and SamSam ransomware

Taylor Armerding, Synopsys Software Integrity Group senior strategist, gives you the scoop on application security and insecurity in this week’s Security Mashup. What’s in this week’s Security Mashup, you ask? Lock the vote (election insecurity), “Spamalot” returns for a second act, and SamSam hits a grand slam as a heavy ransomware hitter.

Continue Reading...

Posted in Software Composition Analysis (SCA) | Comments Off on Lock the vote, ‘Spamalot’ returns, and SamSam ransomware