Online Courses
Security in the Pipeline
Online Courses
Security in the Pipeline
  • Introduction
  • Dependency Management
    • Introduction
    • What are dependencies?
    • Internal vs External
    • Securing External Dependencies
    • Securing Internal Dependencies
    • Theory of a Dependency Confusion
    • Conclusion
  • SAST
    • Introduction
    • Code Review
      • Automated Code Review
    • SAST in the Development Cycle
    • Conclusion
  • DAST
    • Introduction
    • Dynamic Application Security Testing (DAST)
    • Spiders and Crawlers
    • Scanning for Vulnerabilities
    • Authenticated Scans
    • Checking APIs with ZAP
    • Integrating DAST into the development pipeline
    • Conclusion
Powered by GitBook
On this page
  1. Dependency Management

Conclusion

In this room, we discussed the security controls and misconfigurations commonly found with dependency management. This is by no means an exhaustive list of what should be considered for the security of dependencies. However, to summarize, we should be considering the following:

  • Be aware of the dependencies you use in your applications and systems. Also, be aware that these dependencies may have dependencies, which will grow the list of dependencies you will need to keep tabs on.

  • Make sure to always use the latest versions of dependencies, both internal and external dependencies. More often than not, these updates to dependencies are not to introduce new features, but to fix existing issues and bugs.

  • It is not just the dependencies themselves that should be considered for security, but also how we configure and use our dependency managers, especially for internal dependencies.

  • Dependencies and dependency management systems should be included in the attack surface of the application or system we are developing.

PreviousTheory of a Dependency ConfusionNextIntroduction

Last updated 8 months ago