Duration: 0:00

37 views

1

Java is one of the most popular programming languages in the world with a large software ecosystem. A common Java project relies on third-party packages as part of the software supply chain. This often results in hundreds of direct and indirect dependencies. SolarWinds, Log4Shell and other incidents have demonstrated the catastrophic impact of attacks on the software supply chain in general and the Java ecosystem in particular. In this talk, we will look at Software Composition Analysis (SCA) tools approaches: the code-centric approach implemented by Eclipse Steady and the metadata-base approach implemented by OWASP Dependency-Check. Both are mature tools and try to solve the problem of reliably detecting vulnerabilities in package dependencies. While the metadata-based approach is state of the art and widely implemented, the code-centric approach has been developed in recent years. We apply both approaches to a set of Java projects and inspect their results. Our findings show that both approaches have their advantages and downsides, and we propose a hybrid approach to combine the strengths of both. The aim of this investigation is to answer the question of how we can improve the precision and efficiency of vulnerability detection in third-party dependencies and increase the security of our software supply chain. Since the two tools Eclipse Steady and OWASP Dependency-Check are free and open source software, these tools can potentially be used in your own projects. Basic knowledge of software development is sufficient to participate in this session.