Dependency Security Management & Continuous Dependency Remediation

[ducthinh993]

In the modern AppSec program, it's necessary to "shift-left" security & governance for dependency from the Code to the Plan stage.

Conceptual approach

Plan phrase:

For OSS Dependency:

• Benchmark OSS dependency project with OpenSFF Scorecard

For vendor and third-party dependency:

• Involve SBOM as artifacts release manifest in order to be aware of downstream dependencies. The benefits of the SBOM approach allow the security team to perform security assessments without the need for source code - might not available with third-party

Building private dependencies registry to secure store and sign-off for dependency to prevent availability and tampering issues from upstream maintainers

Code phrase:

• Setup proper dependency security scanning tool in CI/CD pipeline
• Setup Dependency Vulnerability Assessment to continuously scan and alerts for new finding developers