loading...
Microsoft Azure

Pushing Left, Like a Boss — Part 5.2 — Use Safe Dependencies

shehackspurple profile image Tanya Janca ・2 min read

**Previously published on my Medium blog, SheHacksPurple. Also, please follow me on Twitter. :-D

According to many sources between 70–90% of application code is contained within libraries and other 3rd party components. When we use libraries, frameworks and other 3rd party components, we are accepting all of the risks that come with them (including vulnerabilities). Luckily for us, when security researchers find security vulnerabilities in products (including libraries, frameworks and other components) they often report them to Mitre, who log them in the Common Vulnerability Enumerator (CVE) database, a publicly searchable database containing all publicly-disclosed known vulnerabilities (note below). Using the CVE database either manually or (preferably) through use of an automated tool, to verify if your application is using known-vulnerable components is a key strategy to improve the security of your custom-built applications. There are many free and premium tools on the market (listed below), and I would suggest that you use at least one of them to ensure that the 3rd party code you are using is safe.

Automating this should be part of every CD/CI pipeline. You should also automate scanning of your source code repository on a regular basis. Everyone should do this, for every project, no matter how small. It’s so easy, and it’s such a huge win for the security of your applications, there is no excuse not to do it.

The Note: The CVE list of vulnerabilities is not exhaustive. Many nation-states (including your own), as well as criminal, terrorist, hactivist, and other malicious groups, actors or organizations do not report zero days (vulnerabilities that are not known to the public) that they find, in order to keep them for use as part of their own nefarious activities. Just because you have scanned your third party components for vulnerabilities does not mean they are bulletproof. Sorry folks.

Photo: #WOCinTechChat

Non-exhaustive list of software that scans 3rd party components for security vulnerabilities:

There is no end of tools to help verify that you are using safe dependencies in your applications. Make use of one or more to ensure you are releasing secure apps!

Up next in the ‘Pushing Left, Like a Boss’ series: Browser and Client-Side Hardening.

Posted on by:

Microsoft Azure

Any language. Any platform.

Discussion

pic
Editor guide
 

dependabot.com/ is worth mentioning - it auto-creates pull requests for new versions.

Security is not the only driver, there's a lot of commits making your packages better all the time that you don't want to miss. Applying updates regularly also makes sure you know what you need to do should you need to quickly update in case of a new critical vulnerabilty.

I have watched developers struggle to update from 5 year old versions, it's not a pretty sight ;)

 

I've added Dependabot, nice! And I agree, 100%!

 

For PHP there is the Sensio Labs Security Checker to scan for vulnerable Composer packages.