If your organization uses open source components,
then using a Software Composition Analysis tool like Dependency‑Check will
form an essential part of your cybersecurity strategy.
As an example, if we look at the NIST Cybersecurity Framework,
we'll see how use of Dependency‑Check could help us meet
our strategic cybersecurity goals.
The NIST Cybersecurity Framework is divided into five
high‑level functions, identify, protect,
detect,
respond, and recover. Dependency‑Check and Software Composition Analysis in
general is something that we do in that early identify stage since it gathers
information that will help us better understand security risks associated with
the systems that we're building and deploying.
In fact,
underneath the identify function in the NIST Cybersecurity
Framework, there is a whole category called supply chain risk
management, which is, of course, exactly what we're using
Dependency‑Check for in this course.
The subcategories SC‑2 and SC‑4 are the most relevant here,
but you may notice that they're written in a language that talks about
things like suppliers and contractual agreements.
We typically don't have those when dealing with open source components.
The point about carefully choosing the components that we use and
making sure that they are routinely assessed with security are still
really relevant to us, though, and we'll explore how best to do that
in the rest of this course.