OWASP Flagship Projects - OWASP Dependency-Check

This course introduces OWASP Dependency-Check for software composition analysis, covering vulnerability data sources, library identification issues, false positives, suppression files, and application onboarding.

Syllabus

Intro
Software Composition Analysis
Primary Data Sources
Vulnerability Data Source • National Vulnerability Database (NVD) List of Common Vulnerability and Exposures (CVE) • Each CVE entry contains • A description of the vulnerability
Library Identification Problems • Development & Security use different identifiers
Evidence Based Identification Issues
Dealing with False Positives Invalid dependency identification can be resolved using a suppression file
Onboarding an Application
Use Cases for dependency-check
How can you help?