From the course: Microservices Security Workshop: From Build to Production

Unlock this course with a free trial

Join today to access over 25,500 courses taught by industry experts.

Software composition analysis (SCA)

Software composition analysis (SCA)

From the course: Microservices Security Workshop: From Build to Production

Start my 1-month free trial Buy for my team

Software composition analysis (SCA)

“

- [Instructor] Now let's look at a scanning category that tends to cause teams a lot of headache and noise, and that's software composition analysis or SCA tooling. This category of tooling picks apart all of the dependencies that makes up your application and uses those to understand where you're vulnerable or not. For our application, it's Python-based, and so we have these requirements.txt files, but in other languages, you might see package.json or Gradle files or Maven files, and these are all just different ways to manage open source packages. Here we have a list of all of these packages with different versions attached to it, and these different versions have vulnerabilities that come up over time. So for example, PyJWT, which we're using, I can go through the different versions here and see when vulnerabilities cropped up with them and which versions are affected by these vulnerabilities. Here, we can see something we talked about, which is bypassing the algorithm that was…

Contents