Managing & Mitigating Open Source Vulnerabilities with Black Duck SCA
The challenge: Managing open source in containers and applications
“We were initially looking for a software composition analysis (SCA) solution to actively monitor our container deployments for open source vulnerabilities,” said Finnur Örn Guðmundsson, infrastructure architect at Íslandsbanki. “We felt we weren’t managing the open source we were using in a consistent fashion, and monitoring it entailed a lot of manual labor on the part of our developers.”
“When we dug more deeply into our needs, we also saw the potential benefit of SCA for our noncontainerized workloads. We wanted to have a tool to scan our packages in the CI/CD pipelines and to be able to stop deployments if there were serious vulnerabilities that might affect us and/or our customers. The development teams would then be able to fix those vulnerabilities during the development cycle. Having a single automated solution to manage the open source in both our containers and standard deployed applications was essential to minimize the workload on our developers.”
Why software composition analysis?
Open source is the foundation for every application in every industry. In fact, the annual “Open Source Security and Risk Analysis” (OSSRA) report from Black Duck found that over 95% of audited codebases contained open source. But paralleling the popularity of open source is a growth in risk—specifically around open source licensing, code quality, and especially open source security. Over eighty percent of the audited codebases examined in the OSSRA report were found to have at least one vulnerability.
Manual tracking of open source is a Sisyphean task; organizations simply can’t adequately track and manage the sheer amount of open source they use by spreadsheet anymore. Software composition analysis is an automated process that identifies security vulnerabilities, license compliance, and code quality issues that may arise from the use of open source in applications and containers.
The solution: Black Duck SCA with Black Duck Security Advisories
“We evaluated a few SCA solutions and did a proof of concept of the three final candidates,” Guðmundsson continued. “Of the three, we found Black Duck® SCA to be the best fit for our needs. At the time of our evaluation, Black Duck SCA was the only solution we tested that was able to scan software whether packaged as containers or as standard deployments.”
Guðmundsson cited Black Duck® Security Advisories (BDSAs) as a key feature of Black Duck SCA. These advisories offer curated and prioritized security notifications reaching well beyond the standard information found in free feeds like the National Vulnerability Database. With thousands of exclusive listings curated by security experts, Black Duck Security Advisories provide timely vulnerability descriptions, severity scoring, and advanced, actionable remediation guidance.
“The BDSAs give us good insight into if a vulnerability might affect us or not, if it is being exploited in the wild, and what package versions fix the vulnerability,” said Guðmundsson. “And Black Duck SCA It makes it easy to see which of our solutions are using the vulnerable package in question.”
The results: A single tool to manage and mitigate open source vulnerabilities
Implemented in April 2021, Íslandsbanki has already seen positive results from Black Duck SCA. “Our CI/CD toolchain includes Azure DevOps, Visual Studio, Docker, and Kenna,” said Guðmundsson. “We have six development teams testing 177 applications, and conduct Black Duck SCA scans for every master branch build and pull request.”
“Implementing Black Duck SCA has given us a single tool to manage and mitigate vulnerabilities, allowing our development, operations, and security teams to see the status of our deployments,” Guðmundsson concluded. “The product is easy and straightforward to use, and we’d recommend Black Duck SCA to anyone looking into an SCA solution.”
Company overview
An Icelandic bank with roots tracing back to 1884, Íslandsbanki offers consumer, private, and corporate banking services, mortgage loans, private equity, wealth management, credit cards, and other financial services to businesses and consumers.
Related content
Five Considerations for Securing Your Software Supply Chain
Download the supply chain security solution guide
Forrester Wave: Software Composition Analysis
See why Black Duck is a software composition analysis Leader
