Your code is mostly other people's code
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
see why dependencies are the largest part of the attack surface.
Planned topics
- A Spring Boot service has hundreds of transitive dependencies; most of the running code is not yours.
- A vulnerability is tracked as a CVE with a severity score (CVSS); a library flaw becomes your flaw.
- Examples of impact: remote code execution through a logging or serialization library.
- Defense is a routine, not a one-time scan: inventory, scan, triage, update.
Draft outline details
Demonstration
mvn dependency:tree of orders, counting direct versus transitive entries.
Check your understanding
Who is responsible for a flaw in a transitive library?
Show answer
You, because it runs in your service.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.