22 docs tagged with "SCA"

Reinforced recommendations for critical contexts or environments with high maturity

Binary verification of the application of the practices prescribed in Chapter 05

Policies for internal repositories, proxies, mirrors and provenance validation

The single index of all security verification in SbD-ToE — activity × type × oracle × chapter × risk level — distinguishing testing (behavioural oracle) from analysis/scanning (lookup/policy oracle).

Organisational policy that defines the criteria, the formal process, the approval authorities, the compensating controls and the reassessment deadlines applicable to exceptions to known vulnerabilities (CVEs) in software dependencies, proportional to the application's criticality level (L1, L2, L3).

Principles, practices and controls to guarantee secure dependency management, SBOM generation and automated software composition analysis

Canonical catalogue of security requirements for the management of third-party dependencies (DEP-001 to DEP-010), with applicability by risk level and acceptance criteria for SBOM, SCA, library governance and update policies.

Generation and management of a Software Bill of Materials (SBOM) with traceability across the lifecycle

Organisational policy that defines the criteria for approving, pinning, blocking, auditing and updating external dependencies in software projects, proportional to the application's criticality level (L1, L2, L3), with a focus on reducing supply chain risk and ensuring traceability.

Practices for proactive updating, TTL, locking and secure version management

Identification and technical analysis of vulnerabilities in containers as a risk signal, not as an automatic decision

Specifics of exception management in the context of SCA/CVE findings

Practices for the control, approval and traceability of external libraries and third-party packages

Practical integration of the dependency management, SBOM generation and SCA execution prescriptions throughout the application lifecycle

Automated integration of SBOM, SCA and exception control into the build and release cycle

Technical and operational indicators for the assessment of the effectiveness of the controls for dependency management, SBOM generation and software composition analysis, with thresholds per risk level and mapping to the cross-cutting SbD-ToE governance dimensions.

Organisational policies that support the practical application of this chapter

Organisational policy that defines the security requirements for continuous integration and delivery pipelines, including mandatory gates, integrated scanners, environment separation, artefact signing, secrets management in the pipeline and promotion approvals, proportional to the criticality level (L1, L2, L3).

Organisational policy that defines the requirements for the security testing strategy throughout the application lifecycle, including SAST, DAST, SCA, IAST, fuzzing and manual testing, with mandatory gates, finding triage SLAs and centralised management of results, proportional to the criticality level (L1, L2, L3).

Types of attack via dependencies and practices for detection and mitigation

Model linking SCA findings, SBOM, backlog and releases

Software Composition Analysis practices to detect, prioritise and mitigate known vulnerabilities