Flagship Projects: Dependency-Check

on YouTube ↗29m

" summary

OWASP Dependency-Check claims to find known vulnerable components by matching dependencies against the NVD and OSS Index, using evidence-based identification from manifests and binaries and offering suppression and hints files to manage false positives and false negatives. It prefers build-plugin analysis (Maven/Gradle) over CLI/docker, caches NVD data locally to avoid NVD rate limits, reports surprising scale like 1,000,000 CLI downloads and 2.5 million Docker pulls, and is actively maintained.

AI-written summary · about

" chapters (10)

1. 0:00Intro
2. 0:35Software Composition Analysis
3. 6:52Primary Data Sources
4. 10:06Vulnerability Data Source • National Vulnerability Database (NVD) List of Common Vulnerability and Exposures (CVE) • Each CVE entry contains • A description of the vulnerability
5. 12:43Library Identification Problems • Development & Security use different identifiers
6. 16:18Evidence Based Identification Issues
7. 17:31Dealing with False Positives Invalid dependency identification can be resolved using a suppression file
8. 18:51Onboarding an Application
9. 25:01Use Cases for dependency-check
10. 28:01How can you help?

" related talks

• 27mFind and Track the hidden vulnerabilities inside your dependenciesJulien Topçu · Voxxed Days Microservices 2018
• 46mSafely through the dependency minefield using OWASP Dependency TrackChristoph Menzel · Øredev 2024
• 01h 00mDependency Check ProjectJeremy Long · OWASP 2022 Global AppSec Europe Virtual Event
• 20mDetect and track the aliens hiding in your dependenciesJulien Topçu · DevFest Nantes 2018
• 34mDependency TrackSteve Springett · OWASP AppSec USA 2018
• 17mDetect and Track the Vulnerabilities Hiding in Your DependenciesJulien Topçu · BDX I/O 2018
• 54mSupply Chain Sec /w Dependency TrackV. Anandan, M. Bhargava, N.J. Duster · Global AppSec Dublin 2023
• 26mKnow Your Dependencies: A Guide to Automating Dependency AssuranceSteve Judd · Cloud Native SecurityCon North America 2022