Pretty much every software composition analysis tool is set up to find vulnerabilities in software applications. And pretty much all of them scan both software applications and their dependencies for known vulnerabilities and provide reports that can help developers identify and remediate potential security issues.
Some SCA solutions also offer automated remediation options, such as patching problematic components, upgrading outdated versions, or suggesting alternative, more secure dependencies. Others offer a related functionality called "remediation guidance", which can also help devs learn about problems and how to fix them up. In some cases, this might be a better play. A few solutions that offer various levels of remediation that you may want to have a look at are Veracode, Snyk, and Mend (was WhiteSource), and Black Duck.
Probably the most important information is which vulnerabilities create a real danger and how to prioritize fixes. It’s often not going to be realistic to fix every issue, either because of the time/work involved or because the actual vulnerabilities don't expose you to a significant security threat. SCA solutions will generally help with that prioritization.
When you say centralized view, do you mean different testing categories which should be looked at for matured software development? If yes, sharing my views on important ones.
1. Functional Testing (either using open source frameworks like playwright, cypress, and selenium or using a platform approach like Katalon, Tricentis, SmartBear).
2) Performance and Load Testing
3) Chaos Engineering
4) Security Testing which includes SCA, SAST, DAST, checking IaaC scripts, checking K8 clusters, docker images
5) Accessibility Testing to comply with WCAG guidelines
6) API testing
The duration of SCA scanning is going to vary depending on things like the size and complexity of the application being scanned, the depth of the analysis required, and the capabilities and performance of the SCA tool being used. That last piece can be crucial and is a good reason to do a PoC or at least some trial runs of any solution you are considering.
In general, an SCA scan can take anywhere from a few seconds to several hours or even days, depending on the size of the codebase and the scope of the analysis. However, many SCA tools are designed to optimize their performance and reduce scanning times by focusing on critical vulnerabilities first, performing incremental scans, and providing parallelization capabilities.
Speed can also depend on the stage at which you're scanning. IDE scanning is generally going to be the fastest. Shared pipeline scans will take longer and full production scans are going to take the longest.
Obviously, speed is important, but fast without accuracy isn't going to do the job, so that's another aspect to keep in mind. Over time, the number of false positives should decrease as your devs learn better coding practices and you learn to configure your scanner for your particular environment.
PeerSpot’s crowdsourced user review platform helps technology decision-makers around the world to better connect with peers and other independent experts who provide advice without vendor bias.
Our users have ranked these solutions according to their valuable features, and discuss which features they like most and why.
You can read user reviews for the Top 5 Software Composition Analysis (SCA...
The world of technology is constantly undergoing both evolutions and revolutions. It is always difficult to know just what kinds of changes and innovations each year is going to bring. The fields of Development and Operations (DevOps) and Development, Security, and Operations (DevSecOps) are two examples where the best people can do is offer their predictions of what might be in store.
PeerSp...
Pretty much every software composition analysis tool is set up to find vulnerabilities in software applications. And pretty much all of them scan both software applications and their dependencies for known vulnerabilities and provide reports that can help developers identify and remediate potential security issues.
Some SCA solutions also offer automated remediation options, such as patching problematic components, upgrading outdated versions, or suggesting alternative, more secure dependencies. Others offer a related functionality called "remediation guidance", which can also help devs learn about problems and how to fix them up. In some cases, this might be a better play. A few solutions that offer various levels of remediation that you may want to have a look at are Veracode, Snyk, and Mend (was WhiteSource), and Black Duck.
Probably the most important information is which vulnerabilities create a real danger and how to prioritize fixes. It’s often not going to be realistic to fix every issue, either because of the time/work involved or because the actual vulnerabilities don't expose you to a significant security threat. SCA solutions will generally help with that prioritization.