Safely through the dependency minefield using OWASP Dependency Track
summary
Claims a practical pipeline: generate a Cyclone di SBOM, upload it to OWASP Dependency-Track, and get continuous daily scans against NVD and other feeds. Demo creates an SBOM that found 72 packages, surfaces a student project with 233 components, and inspects a Docker image with 220 components. Policy rules block licenses (example: BSD‑3) and Slack alerts trigger on new CVEs. CI integration uses the API with a base64 upload in about 10 lines of code.
AI-written summary · about
chapters (17)
- 0:00Introduction
- 1:04Dependency tracking matters
- 4:38Software Bill of Materials
- 8:33Creating SBOM with CycloneDX
- 12:59When SBOMs are needed
- 15:06OWASP Dependency-Track intro
- 20:19Dependency-Track local setup
- 21:44Analyzing projects in DT
- 23:10Dependency tree navigation
- 27:27Auditing vulnerabilities
- 29:37Enforcing policies in DT
- 33:50Configuring DT settings
- 35:16CI/CD integration
- 37:28Start using SBOMs
- 39:18Q&A
- 40:43Q&A
- 43:01Community contribution & closing
related talks
54mSupply Chain Sec /w Dependency Track
26mKnow Your Dependencies: A Guide to Automating Dependency Assurance
24mDependency Track Fortifying The Supply Chain
30mSecuring DevOps using OWASP DevSecOps Tools
25mFlagship Projects: Dependency Track
23mSupply Chain Security using Free and Open Tools
21mSecuring Diverse Supply Chains Across Interconnected Systems
29mFlagship Projects: Dependency-Check