Hackfest 2024 - Édition 16-bit

• What is SCA?
  An automated process for identifying software dependencies that could have critical vulnerabilities or licensing issues

• Overview of Scanning, Triaging and Remediation.
  Deploying the scanner is the obvious first and most technically demanding step. For this reason, triaging and remediation of findings is often overlooked. Most organizations end up with a large number of findings and false positives, overwhelming security and engineering teams. For this reason, it is important to put some forethought into triaging and remediation.

• How Vulnerable and Outdated Components enter your software chain?
  For us to tackle any problem we need to understand the root cause. How do you end up with vulnerable third party dependencies? There are two main ways that this happens:

  1. Developers introduce older version of a dependency = close the floodgates
  2. Developers forget to update existing dependencies = tackle the backlog and enforce good dependency hygiene

• Scanning Approaches
  There are three main ways to implement scanning

  1. A periodic scan (cron job)
  2. A service that integrates with your SCM to perform asynchronous scans
  3. Scans built into CI/CD
     We will cover the pros and cons of each approach, technical details about how we went about implementation and what's worked for us.

• Delving deeper into the design
  Often companies rely on a black box approach to scanning. This could result in issues such as:

  1. Bugs in vendors tools breaking the CI/CD pipelines
  2. Vendor takes time to support the newest version of lock files or package manager, slowing engineering down
  3. Engineering moves to a new build system which the vendor does not support
     To address the above issue we’ll look into using SBOMs for standardizing and decoupling scanning from the build process. We’ll also explore some other advantages of using SBOMs. We will also explore scaling challenges and how to address them. (e.g by using Argo Workflows)

• Triaging
  Now that we have scanning in place, we will soon be overwhelmed with findings. The following has helped us with triaging:

  1. Setting benchmarks. For example in a microservices environment you might want to prioritize edge services, deprioritize certain vulnerability classes (e.g DoS) and exclude test dependencies
  2. Reachability Analysis
  3. Old school PoC or GTFO. Good security engineers can help increase developer productivity while not compromising security.
  4. Uploading results to a vulnerability management platform (e.g defect dojo)

-Remediation
In most organizations, developers will be responsible for remediation. Vulnerability SLAs are just a start. Consider uploading findings to a developer console such as backstage and try to gamify remediation.

-High level overview architecture diagram