Government Security News April May 2015

Vulnerabilities in your software?
Continued from page 11
urges software developers to use
the newest versions of third-party
components, with the most
recent vulnerability patches, as
older versions are not always
updated. Although time-consuming,
OWASP recommends
making sure all components and
versions are identified and the
security of these components is
frequently monitored. They also
suggest establishing tight security
policies regarding the
use of components, and consider
using security wrappers
around components
to disable unused functionality
and/or secure weak or vulnerable
aspects of the component.
Identification Tools
Furthermore, OWASP advises
developers to use tools that are
specifically designed to identify
vulnerabilities in third-party
components and open-source
software. Some examples include:
Dependency-Check, an
open-source tool used to scan
Java and .NET applications and
their dependent libraries to identify
any known, publicly disclosed,
vulnerabilities; as well as
Retire.js, another popular tool to
help detect vulnerable JavaScript
components.
Furthermore, solutions developed
by Sonatype and Black
Duck Software are also helping to
address the third party component
challenge. Sonatype offers
a patented approach to provide
software developers and security
analysts with valuable data on
component vulnerabilities. This
data can then be integrated with
other tools, such as application
security testing tools, to ensure
an application is void of vulnerabilities.
And, Black Duck offers a
range of code scanning and code
matching products and services
that provide users with visibility
into their code assets, help them
discover what open source code
is used within specific applications,
direct them to the code
origin and code provenance, and
assist them with license identification.
Take the Necessary
Precautions
In recent years, software provid-
48
ers have become increasingly
aware of potential vulnerabilities
in their code and many have taken
steps to reduce the weaknesses
in their custom code. However,
with applications using approximately
30 or more third-party
components in their applications,
their security measures must extend
beyond their own code. All
it takes is one vulnerable component
to enable an attacker to gain
access to mission-critical data or
take down an entire enterprise.
By leveraging application
security testing solutions
to focus on the custom
code in conjunction with
tools that identify vulnerabilities
in third-party components,
software developers will be
able to more quickly find and fix
weaknesses throughout the software
development lifecycle and
prevent malicious cyber security
attacks.