Blogs – Cryptosoft

Technology

The value of Project Collections in OWASP® Dependency-Track

[vc_row][vc_column][vc_column_text]Dependency-Track is a powerful tool for managing software components and their associated vulnerabilities. As your project portfolio expands, gaining a clear, aggregated overview of your risk posture becomes paramount. This is where a feature of Dependency-Track’s project management capabilities, Project Collections, can be a big help to you. By effectively utilizing Project Collections, often in […]

Technology

Managing Internal Components Using OWASP® Dependency-Track

[vc_row][vc_column][vc_column_text]OWASP® Dependency-Track is a powerful open-source platform that helps development, security and DevOps teams identify and reduce risk in their software supply chain. One of its lesser known yet immensely useful features is the ability to specify internal components. In this blog, we’ll explore the what, why, and how of internal components—plus walk you through […]

Security

Enhancing Supply Chain Security with VDR and VEX

[vc_row][vc_column][vc_column_text]In today’s complex software supply chains, understanding and managing vulnerabilities is a top priority. A Software Bill of Materials (SBOM), like the OWASP® CycloneDX format, provides an “ingredients list” of all components in a software system. However, once you know what’s inside, the next challenge is communicating and acting on vulnerabilities found in those components. […]

Security

Accelerating Supply Chain Risk Remediations using OWASP® Dependency-Track

[vc_row][vc_column][vc_column_text]OWASP Dependency-Track offers a robust notification framework that alerts users to new vulnerabilities, system events, and changes within their usage of components. This capability ensures that teams remain informed about critical issues, enabling prompt responses to potential risks as they arise following vulnerability database updates over time. Notification Scopes and Levels Notifications are categorized into […]

Technology

Automating SBOM Creation and Analysis by OWASP® Dependency-Track with a Bash Script

[vc_row][vc_column][vc_column_text]Automating the generation and management of a Software Bill of Materials (SBOM) is essential for software transparency and software supply chain security. This short guide introduces a sample Bash script that simplifies the process by generating an SBOM using cdxgen and uploading it to OWASP Dependency-Track for continuous monitoring. How It Works We’ll reference the […]

Security

How To Protect Your Software Supply Chain From Vulnerabilities Identified In The Future

[vc_row][vc_column][vc_column_text]OWASP Dependency-Track is a powerful tool for managing Software Bill-Of-Materials (SBOMs) and proactively identifying vulnerabilities in your software supply chain. Once your SBOM is uploaded, Dependency-Track can, at a time interval defined by you, continuously monitor it against various vulnerability databases to detect new threats as they are discovered. This guide will walk you through […]

Technology

Best Practices for SBOM Generation: Enhancing Quality and Adhering to Industry Standards

[vc_row][vc_column][vc_column_text]In an increasingly interconnected world, the need for transparency in software development has become paramount. Software Bill of Materials (SBOM) generation is a critical activity in software development that enables organizations to understand the components within their software, identify vulnerabilities in third party open source components, manage Open Source Software (OSS) license risk and identify […]

Security

How Dependency-Track Secures the Software Supply Chain

[vc_row][vc_column][vc_column_text]In today’s increasingly interconnected software development landscape, the security of the software supply chain is more critical than ever. With the growing use of third-party components, particularly open-source libraries, organizations face a significant challenge in ensuring the security of these dependencies. So, to protect the software supply chain, Dependency-Track provides a powerful solution to proactively […]

Security

Cyber Resilience Act 10132024: A wake-up call for software development organizations

[vc_row][vc_column][vc_column_text]After having been adopted by the European Parliament and also on October 10 by the European Council,, the EU Cyber Resilience Act will come into force in the next few weeks. Now, manufacturers of products with digital (i.e. software) content that are connected to a network or another device, will have 36 months to comply […]

Security

Ensuring OSS License Compliance with Cryptosoft OWASP® Dependency-Track

[vc_row][vc_column][vc_column_text]In today’s software development landscape, the use of open-source software (OSS) is ubiquitous. Open-source components allow developers to innovate quickly by building on the work of others, leading to faster time-to-market and reduced development costs. However, the widespread use of OSS also introduces the challenge of managing and ensuring compliance with the licenses associated with […]

Security

Reducing Technical Debt with Dependency Track

[vc_row][vc_column][vc_column_text]Managing dependencies and ensuring the security of software can be challenging in today’s fast-paced software development landscape due to the implementation of modern development methodologies like CI/CD, microservices and continuous updates. As software grows, the complexity of maintaining dependencies increases, leading to an increase in technical debt—an accumulation of outdated, inefficient, unused, or vulnerable dependencies […]

Security

Polyfill.io Supply Chain Attack: A Wake-Up Call for SBOM Adoption

[vc_row][vc_column][vc_column_text]The recent Polyfill.io supply chain attack, affecting over 100,000 websites, has been a wake-up call for the software development community. This attack embedded malware into JavaScript CDN assets, compromising the integrity and security of countless applications. As we dissect this incident, it’s clear that creating and analyzing Software Bill of Materials (SBOMs) as part of […]

Security

Best practices for assessing today’s software risks

Today’s software offerings are constructed from a plethora of home-grown, open-source, purchased and AI-generated code. Assessing the vulnerability risk in each of these components is common practice in DevSecOps processes, but it’s becoming increasingly apparent that the combination and interdependencies between these components often creates intolerable risk that is not exposed from standard vulnerability practices. […]

Security

Why SBOM analysis is a prudent augmentation of your security strategy

Software Bill of Materials (#sboms ) provide producers and consumers of software with transparent information on components, and their interdependencies, within a software package. SBOMs have emerged as being essential to managing security risk and licensing within today’s applications. Managing software security and licensing without SBOMs was hardly possible. Think of the pain that many organizations suffered […]