OWASP Global AppSec US 2021

Software Composition Analysis (SCA) is becoming increasingly popular in addressing the increased risks from software supply chain attacks. However, the practice of SCA is still uncommon in non-mature software development teams which allowed patch debt from emerging libraries to accumulate over the years. In this presentation, we’ll discuss how OWASP Dependency-Check was successfully used to enable a decentralized large-scale SCA exercise on hundreds of third-party vendor managed applications in two months. Specific topics include process design, automation, monitoring and vendor interaction.