From the course: Building an Application Security Program

Unlock this course with a free trial

Join today to access over 25,500 courses taught by industry experts.

Static code analysis (SCA)

Static code analysis (SCA)

From the course: Building an Application Security Program

Start my 1-month free trial Buy for my team

Static code analysis (SCA)

“

- [Instructor] Now, let's talk about software composition analysis, or SCA. SCA is a tool that is used by security teams to help identify open-source software in an application. It has a couple of functions. It lists of vulnerabilities that are known for each of the open-source components or libraries that are found. It also lists the license type for each of the libraries. The license type is something that not everybody thinks about when performing security testing, but this is important from a privacy perspective. The type of license that an open-source component uses can affect how you distribute the application and what rights you have to include when releasing your software. SCA is important, especially in today's world of supply chain attacks. Open source is used in almost every single application that is developed. Rather than writing the same code over and over, developers like to reuse code, and open source…

Contents