It's a trap; we are vulnerable
summary
Sonar only reports source-code issues and Sonar misses dependency vulns, so the demo contrasts Snyk (accurate but costly), Dependency-Check (free but each project re-downloads the whole DB) and Dependency-Track, which consolidates CycloneDX BOMs, queries NVD and other sources, and enforces policy “quality gates.” The demo generates a CycloneDX BOM from Maven, uploads it to a local Dependency-Track (admin/admin), finds four critical vulns then ten policy violations, and integrates with Jenkins via CycloneDX BOM and a Dependency-Track app key to automate enforcement.
AI-written summary · about
chapters (11)
- 0:00Introduction and speaker intro
- 1:48Problem context and vulnerabilities
- 6:44Security and dependency challenges
- 10:00Dependency Track overview
- 14:15Generating BOM files with CycloneDX
- 22:30Setting up Dependency Track
- 25:24Uploading BOM and analyzing results
- 27:34Creating quality gates and policies
- 30:52Automating with Jenkins
- 37:05Alternative approaches and API
- 38:11Best practices and conclusion
related talks
46mSafely through the dependency minefield using OWASP Dependency Track
24mDependency Track Fortifying The Supply Chain
54mSupply Chain Sec /w Dependency Track
34mDependency Track
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
27mFind and Track the hidden vulnerabilities inside your dependencies
27mDep-scan
25mFlagship Projects: Dependency Track