Software is only as safe as the code used to build it. Today, more than 90% of all new software is built using open source code, which can contain unknown risks and dependencies. Software Composition Analysis is a critical tool in reducing risks with third party packages.

SOOS’s Software Composition Analysis (SCA) tools mitigate this risk by scanning an application’s code base to identify open source components, license data, and vulnerabilities. With a clear view of what’s inside, developers can proactively address any issues and minimize the risks. Software Composition Analysis should be initiated early in the development lifecycle, and repeated continuously.

Here’s how SOOS’s software composition analysis tool makes your software safer…

Step 1: Inventory of Components

The first step in securing your code is to take stock of the open source components and dependencies. Our SCA tool scans your application’s code base, including containers and registries. This provides a critical accounting of all your open source components.

Step2 : Vulnerability Analysis

Once you have a full inventory of the components, SOOS searches for known vulnerabilities and brings security risks out of hiding. Systems typically provide information from the National Vulnerability Database (NVD) and the Common Vulnerabilities and Exposure (CVE) disclosures.

Step 3: Research and Prioritization

Not all risk is created equal. Our tool prioritizes security vulnerabilities to ensure the biggest threats are addressed first. 

Step 4: Fix Remediation

It’s not enough to simply locate vulnerabilities, the issues need to be addressed. SOOS provides remediation options and accelerates fixing the build.. 

Step 5: License Compliance

It’s essential to understand the terms and conditions of every open source component embedded in your application. Our SCA tool ensures you are aware of all the required permissions, including direct and transitive dependencies. It is important to begin software license management early in the SDLC because changing components at a later time is time intensive and requires retesting.

Step 6: Integration & Governance

Use SOOS to implement an integrated and continuous detection, assessment, and correction framework to govern your SDLC. SOOS integrates into your CI/CD, Repository and Issue Management adding an intelligent rule system to ensure compliance with your standards. 

Step 7: History

Capture the full SCA history of your application to inform future development decisions and improvements.

Step 8: SBOM/Vex Generation & Reporting

It’s not enough to secure your code. You need to show your work. 

A Software Bill of Materials (SBOM) provides an overview of an application’s components, including vulnerabilities, and is increasingly requested by customers and end-users from their software vendors to ensure the safety of an application. The United States Federal Government requirements for SBOM generation are fast approaching. Use SOOS to generate your SBOMs.

VEX stands for Vulnerability Exploitability eXchange. It is a companion artifact to an SBOM that preemptively assesses the vulnerability of issues named in an SBOM. This is important because not all vulnerabilities are high-risk in a particular product. 

SCA is an essential step in the SDLC

Open source code has become ubiquitous, but far too many organizations bypass Software Composition Analysis, leaving their applications, and their users, open to untold risk.

SOOS offers an affordable, streamlined solution to Software Composition Analysis SCA, to make software safer for everyone.