Black Duck® software composition analysis (SCA) helps teams manage the security, quality, and license compliance risks that come from the use of open source and third-party code in applications and containers.
Black Duck met Entersekt's checklist of what we needed in an open source vulnerability management solution better than any other vendor."
Quality Assurance Manager, Entersekt
Black Duck’s multifactor open source detection and KnowledgeBase™ of over 6.3 million components gives you complete visibility into the composition of any application or container.
Integrates with build tools like Maven and Gradle to track both declared and transitive open source dependencies in applications built in languages like Java and C#.
Maps string, file, and directory information to the Black Duck KnowledgeBase to identify open source and third-party components in applications built using languages like C and C++.
Identifies open source within compiled application libraries and executables. No source code or build system access required.Learn more
Finds parts of open source code that have been copied within proprietary code, which can potentially expose you to license violations and conflicts.
Black Duck’s discovery technology lets you compile a complete SBOM (Software Bill of Materials) of the open source, third-party, and proprietary software components used to build applications and containers. Exporting an SBOM in NTIA-compliant formats such as SPDX and CycloneDX enable you to establish trust in your applications and track related security, license, and operational risk.
Black Duck Security Advisories help you avoid being caught off-guard by open source vulnerabilities, both in development and production. And they provide the critical data necessary to prioritize vulnerabilities for remediation, such as exploit info, remediation guidance, severity scoring, and call path analysis. Learn more about Black Duck's vulnerability database.
Timely. Thousands of security feeds are monitored and enhanced to provide same-day notification of most vulnerabilities—weeks before they appear in the National Vulnerability Database.
Accurate. Our team of security experts review and verify vulnerability data to ensure accurate reporting on vulnerability descriptions, severity, exploit risk, and affected versions.
Actionable. Mitigation and remediation guidance detailed by our teams help prioritize vulnerabilities, select optimal patch or upgrade path, and identify evidence of attack or compromise.
Automated. Vulnerabilities are prioritized for remediation based on critical vulnerability data, such as severity, available solutions, exploitability, CWE, and call path analysis.
Black Duck automated policy management allows you to define policies for open source use, security risk, and license compliance up front, and automate enforcement across the software development life cycle (SDLC) with the tools your developers already use. Learn more about our DevOps Integrations.
Identify, avoid, or automatically remediate components that are higher risk or violate policy, as you code.
Automate scans, alerting or halting builds based on policy violations using CI tools like Jenkins.
Inspect apps and containers before they are deployed and get automated security alerts after.
Whether your software is delivered via the web or embedded in a hardware device, compliance with open source licenses is critical. Mitigate the cost and risk to intellectual property with greater insight into license obligations and attribution requirements. Learn more about open source license compliance.
Black Duck maps identified components to one of over 2,700 licenses tracked in our KnowledgeBase, and flags components with unknown licenses so they can be reviewed.
Obligation summaries explain license requirements in simple and standard terms so development and legal teams can quickly assess the impact of including a component in their application.
Black Duck automatically flags potential license conflicts so teams stay in compliance with policy enforcement, and helps them accurately report license terms for customers.
Enable developers and DevOps teams to address open source policy concerns without slowing innovation.
per team member
(20-150 team members)
Equip the entire enterprise with a holistic open source risk management solution, providing policy-based governance from development to production.
Open source security is often overlooked due to the misconception that vulnerabilities in proprietary code and open source code can be detected and remediated in similar ways. The reality is that SAST, DAST, and other application security testing tools cannot effectively detect open source vulnerabilities. Enter SCA.
The key differentiator between SCA and other application security tools is what these tools analyze, and in what state. SCA analyzes third-party open source code for vulnerabilities, licenses, and operational factors, while SAST analyzes weaknesses in proprietary code, and DAST tests running applications for vulnerable behavior.
A comprehensive software security program contains both SAST and SCA. Organizations that adopt such an approach see improvements throughout the SDLC, including improved quality through early identification of issues, better visibility across proprietary and open source code, lower remediation costs by detecting and fixing vulnerabilities early in the development process, minimized risk of security breaches, and optimized security testing that is both effective and compatible with agile development.
Black Duck offers easy-to-use open source integrations for the most popular development tools and REST APIs, allowing you to build your own integrations for virtually any commercial or custom development environment. Black Duck offers a wide range of integrations across the SDLC, including IDEs, package managers, CI/CD, issue trackers, and production capabilities.
Most solutions rely solely on data from the National Vulnerability Database (NVD). This limitation presents a problem, as many vulnerabilities are never documented in the NVD, and others are not listed until weeks after they become public. Black Duck Security Advisories (BDSAs) go beyond the NVD, with enhanced data that is researched and analyzed by the Synopsys Cybersecurity Research Center (CyRC) to ensure completeness and accuracy, providing early warning and complete insight.
Most solutions use package manager declarations to identify open source components. But failing to scan for more than declared dependencies guarantees that you’ll miss some open source. And if you don’t know it’s there, you can’t ensure it’s secure and compliant.
Package manager scanning will overlook open source that developers don’t declare in package manifests, languages like C and C++, open source built into containers where no package manager is used, open source that has been modified, or partial snippets of code that still carry license obligations. By combining file system scanning and snippet scanning with build process monitoring, Black Duck provides visibility into open source components not tracked by a package manager, partial open source, and open source that was potentially modified or not declared, as well as component and version verification for dynamic and transitive dependencies.
The short answer is an extensive and powerful solution that provides end-to-end control of open source risks. A solution like Black Duck provides a comprehensive approach to open source management throughout the entire SDLC.
More specifically, the following capabilities should be considered when selecting an SCA solution:
Black Duck supports the most common package managers. Black Duck’s snippet scanning covers the top and most frequently used languages. The expert KnowledgeBase team is constantly monitoring for and adding new languages, ensuring that all common languages are supported.
Additionally, Black Duck’s proprietary signature scanning approach is language-agnostic. This scanning approach searches for signatures based on file and directory layouts along with other metadata that is independent of language.
Contact us for the most current list of supported languages and platforms.
Yes. Some solutions can scan binaries for package manager information or binaries pulled directly from a repository without any modification. Black Duck’s sophisticated binary scanning solution can crack binaries open to detect modified binaries and provide legacy language and broad artifact support.
Black Duck’s open source KnowledgeBase is the industry’s most comprehensive database of open source project, license, and security information, sourced and curated by the Synopsys Cybersecurity Research Center (CyRC). The KnowledgeBase contains more than 2,650 unique open source licenses (GPL, LGPL, Apache, etc.), with full license text for the most popular open source licenses and dozens of encoded attributes and obligations for each license. Black Duck also includes deep copyright data and the ability to pull out embedded open source licenses for complete open source compliance.
Yes. Black Duck allows teams that package and deliver applications using Docker (and other) containers to confirm and attest that any open source in their containers meets use and security policies, is free of vulnerabilities, and fulfills license obligations. Open source management includes ongoing monitoring for new vulnerabilities affecting existing applications and containers.