What is Software Composition Analysis and Why is it
Important?

 

Overview

In this post, we will be discussing the definition, relevance and the growing importance of Software Composition Analysis. Then, we will be focusing further on the three steps it took to reach its current state. Finally, we will be viewing and explaining the Maturity Model and its importance in addressing software organizations with their level of security. Finally, closing with some final thoughts on SCA and its future.

Definition

Software Composition Analysis solutions, or OSS Security Scanning, solutions and services provide the OSS audits by analysing the source code and files constituting the application in order to provide the company with the complete inventory of commercial, proprietary, and open source components, including all direct and transitive dependencies, used in that particular application. But in practice, it acts as an open source management tool only, because its real purpose is dealing with open sourced code.

 

Why is it Relevant?

SCA is definitely relevant to any enterprise that uses or utilizes any open-sourced applications, as many studies have shown in the recent years the growing vulnerability that open sourced applications have on the security of companies and their data. Also, as a matter of fact, open source components have become the main building block in software applications across the board. However, companies have shown many examples of security-related holes in their system such as leaks in data, of theirs or their customers, because they were not dealing with the security of their applications properly and that they need a solution for this critical issue. SCA comes in to help the company identify and assess the risks that might arise later on from their open sourced libraries, working on both security and license risks, reducing the amount of work and expenses on future security defects.

 

Moreover, the fact that companies are understanding the real need for such a system can be seen by looking at the market. It is expected to grow even further in the coming years. The software composition analysis market is expected to grow from around USD 150 million in 2017 to about USD 400 million by 2022, at a CAGR of 20.9% during the forecast period.

 

For more information on the relevance and the future of SCA, check this blog post.

 

Software Composition Analysis

SCA tools can be seen to constitute three phases marked by the differences they have in their technological advances.

 

1st Generation: Open Source Code Scanning

Since the early beginnings of the spread of open-sourced applications, open source code scanning has provided different companies with the ability to oversee their products and their security-related issues in their open source inventory. This was done by analyzing parts of their code and comparing it with already existing open source databases. However, this proved to not be that practical, when many false positives were being identified. This means that proprietary and commercial bits of code where being falsely recognized as open sourced, requiring other tools and services to recheck the results of the code scanning and identifying those false positives.

 

The backfalls of this system are various, however. Companies realized that soon after using it, as the scanning time is lengthy, its incompatibility with software development lifecycle (SDLC) continuously and the high error percentage (false positives) in its results. This has made it an ineffective tool for solving the issue of vulnerability in the software production world.

2nd generation: Continuous Open Source Components Management

Later on, a new technology was created to match the demand of modern agile production standards. Continuous management of open source components differs from its previous version in that it integrates with various software development tools, such as repositories, build tools, package managers and CI servers. It detects the open source components, dealing with vulnerabilities and licensing issues, in real-time.

This shift to real-time detection of vulnerabilities and licensing issues has benefited security specialists largely by allowing them to detect problematic bits of coding early on, making solving the issue easier and simpler.

3rd generation: Effective Usage Analysis

This newborn technology can supply the companies with much more than simply identifying the components that are present in the application. Investigating on a deeper level on how each of the components is being used, noting its effect on the security of the application, with suggested actions to be taken.

 

For more information on the three different generations, check this blog post.

 

Maturity Model

The maturity model support for legal, security and development specialists by detecting the existing gaps and direct future investment. It provides a place to start from, a benchmark that can be used to see where different companies stand, process maturity and business value and a description for what improvement actually mean to the company.

 

Security and license compliance maturity in a company is measured in relation to these four dimensions:

Vulnerability management: to avoid security defects arising from using third-party components.

License management: to manage open source license dependencies and minimize legal risks effect.

Obligation management: to manage obligations related to the use of open source software, based on associated licenses and company regulations.

Component management: to provide a view on what components are used, and integrate this view in usage and product roadmap decisions.

 

Closing Thoughts

We have seen that SCA is quite essential for any company that relies on open source code, which means the majority of today’s companies. This, however, does not necessarily mean that issue is solved. Because the purpose of this tool is more to help identify the issue in the code, rather than fixing it. The latter part should be addressed and solved by the company as it is their responsibility to uphold and maintain the security of their customers’ data from malicious bits of code. This means that we will be seeing new upgrades for this tool in the future to catch up with the speed at which the open source software universe is growing at. This means that companies need to be more and more careful with their apps.

In conclusion, we have gone through the definition of Software Composition Analysis and its growing importance and popularity among software companies. Later on, we dived deeper into the various generations of SCA with the different features they offer in terms of security and practicality, and concluding with some final thoughts on its future.

 

References

Software Composition Analysis and OSS Security Scanning featured on Gartner’s 2017 Top Technologies for Security

http://blog.klocwork.com/open-source/software-composition-analysis-and-oss-security-scanning-featured-on-gartners-2017-top-technologies-for-security/

 

Global Software Composition Analysis Market 2018-2022-High Adoption in the Fintech Sector

https://www.prnewswire.com/news-releases/global-software-composition-analysis-market-2018-2022—high-adoption-in-the-fintech-sector-300627191.html

 

Introducing the Software Composition Analysis Maturity Model

https://dzone.com/articles/introducing-the-software-composition-analysis-matu

 

Software Composition Analysis: Identify Risk in Open Source Components

https://www.whitehatsec.com/blog/software-composition-analysis/