Application Security · AS-Q02

Question: Are third-party components and open-source libraries regularly inventoried and monitored for vulnerabilities?

  1. Objective — Why This Matters
    Modern software relies heavily on open-source. Without visibility and updates, vulnerable components expose the entire stack.

  2. Maturity Levels (0 – 5)

0 — Unaware
No inventory of dependencies.
1 — Ad Hoc
Developers update packages manually when issues arise.
2 — Defined
Dependency list maintained per project.
3 — Managed
Automated dependency scanning and alerts.
4 — Integrated
SBOM generated; CI/CD blocks known vulnerable packages.
5 — Optimized
Centralized governance; threat-intel feeds prioritize patches.
  1. How to Level Up
From → To Actions
0 → 1 List libraries manually per repo.
1 → 2 Standardize dependency file (npm audit, pip freeze).
2 → 3 Integrate SCA tool in CI.
3 → 4 Generate SBOM and enforce policy on build.
4 → 5 Add intel feeds and risk-based prioritization.

  1. People / Process / Technology Enablers
    People – Developers, AppSec.
    Process – SCA review workflow, update policy.
    Technology – OWASP Dependency-Check, Syft, Grype, Dependabot.

  2. Evidence Required
    SBOM files, scan reports, remediation logs.

  3. Metrics / KPIs
    • percentage of projects with SBOM coverage
    • number of outdated packages per application
    • average time to update critical component

  4. Low-Cost / Open-Source Options (MSME)

Purpose Tool Notes
Inventory Syft Generate SBOM from source or container.
Scanning Grype / Dependency-Check Detect CVE vulnerabilities.
Automation Dependabot Auto pull requests for updates.

  1. Common Pitfalls
    Ignoring transitive dependencies; no approval process for new libraries.

  2. Compliance Mapping

Standard Clauses / Notes
ISO 27001 A.8.9 / A.8.25.
NIST CSF 2.0 PR.IP-1 / PR.DS-3.
CERT-In 2022 Third-party component management.
NIRMATA Scoring AS-Q02 ≥ Level 4 requires SBOM enforcement.