SCA and triage
On This Lesson 4 topics
This lesson is planned. The outline below lists the topics it will cover. The full lesson has not been published yet.
In this lesson
run software composition analysis (SCA) and decide what to fix first.
Planned topics
- SCA tools (OWASP Dependency-Check, Dependabot, Snyk, Trivy) match your dependencies against vulnerability databases.
- Triage by severity, exploitability (is there a known exploit), reachability (does your code call the vulnerable function), and exposure (internet-facing or not).
- Outcomes per finding: fix (upgrade), mitigate, or accept with a documented reason and an expiry date.
- Automate update pull requests so upgrades stay small.
Draft outline details
Demonstration
triage table: CVE, library, severity, reachable?, internet-facing?, decision, owner, due date.
Check your understanding
Name two factors besides severity for triage.
Show answer
Exploitability, reachability, or exposure.
Practice
Apply this lesson with the module's lab, exercises and quiz.
Marking a lesson complete is optional and you can undo it any time. Your progress stays in this browser.