600 apps in 60 days: Our journey to uncover vulnerable dependencies at scale with ...
summary
Centralized process uses OWASP Dependency-Check run by vendors, reports uploaded to SharePoint, parsed by a Python pipeline into a data warehouse and Dependency-Track, and visualized with Power BI to track trends. The program scans 600 apps in 60 days, drives vendor remediation workflows, and yields about a 70% reduction in critical/high library vulnerabilities; false positives from CPEs require per-project suppression and occasional manual dispute resolution with vendors.
AI-written summary · about
chapters (13)
- 0:00Intro
- 3:29Possible Challenges with Outsourced App Development
- 13:08Considerations for Centralized Vulnerability Management Tools
- 16:18People, Process Technology
- 25:48Evaluation of SCA Tools
- 27:11SCA Tool Success Factors
- 30:33SCA Tool Operational Architecture (3rd iteration)
- 35:35SCA Tool Operational Architecture (4th iteration, WIP)
- 36:32SCA Tool Evaluation Comparison (Revised)
- 37:31False Positive from overly broad NVD CPE
- 40:04Suppression Method
- 44:05Scanning base products
- 45:08Vendor's Challenge of non-exploitability
related talks
52mApplication Security at DevOps Speed and portfolio scale
46mSafely through the dependency minefield using OWASP Dependency Track
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
24mDependency Track Fortifying The Supply Chain
27mFind and Track the hidden vulnerabilities inside your dependencies
43mBuilding a Secure DevOps Pipeline
40mNurture vs. Nature in AppSec: Data-Driven Measurement of DevSecOps
33mBattle Tested Application Security