This document discusses using components with known vulnerabilities and provides recommendations and tools to address this issue. It begins with an overview of the OWASP top 10 issue of using vulnerable components and provides examples using the NodeJS decompress package and Ruby on Rails rubyzip gem. It then recommends regularly scanning for vulnerabilities, subscribing to security bulletins, and keeping components up-to-date. Finally, it introduces several open source tools for detecting vulnerable components, such as OWASP Dependency-Check and Dependency-Track, as well as standards for application security verification.

1. Software Supply Chain Security
A9: Using Components with
Known Vulnerabilities

2. Agenda
• OWASP Top 10. 2017. A9. Using Components with Known
Vulnerabilities
• Example 1. NodeJS + decompress npm package
• Example 2. Ruby on Rails + rubyzip gem
• Recommendations and tools
• Q&A

4. Is the Application Vulnerable?
• You do not know the versions of all components you use
• Software is vulnerable, unsupported, or out of date
• You do not scan for vulnerabilities regularly
• You do not subscribe to security bulletins
• You do not fix or upgrade the underlying platform, frameworks, and
dependencies in a risk-based, timely fashion
• Developers do not test the compatibility of updated, upgraded, or
patched libraries
• you do not secure the components’ configurations (OWASP Top-10
A6:2017-Security Misconfiguration)

5. Example 1. NodeJS + decompress npm package

6. Example 1. NodeJS + decompress npm package

7. Example 1. NodeJS + decompress npm package

8. Example 1. NodeJS + decompress npm package

9. Example 2. Ruby on Rails + rubyzip gem

10. Example 2. Ruby on Rails + rubyzip gem

11. Example 2. Ruby on Rails + rubyzip gem

12. SAMM 2.0

13. OWASP Application Security Verification Standard

14. Tools
• npm audit
• Retire.js
• Vulners agent/nmap/nessus/etc.
• OWASP Dependency-Check
• OWASP Dependency-Track

15. OWASP Dependency-Check
• https://owasp.org/www-project-dependency-check/
• Version 5.3.2
• Command Line
• Ant Task
• Maven Plugin
• Gradle Plugin
• Jenkins/SBT/Leiningen Plugin

18. OWASP Dependency-Track
• 3.8.0
• Intelligent Supply Chain Component Analysis platform
• Open Source
• Dashboard
• API and Integration

19. OWASP Dependency-Track

20. Links
https://owasp.org/www-project-top-ten/OWASP_Top_Ten_2017/
https://owasp.org/www-project-dependency-check/
https://owasp.org/www-project-dependency-track/
https://owasp.org/www-project-application-security-verification-
standard/
https://owasp.org/www-project-samm/

21. Q&A