Difference between revisions of "OWASP Jupiter"

Making matters worse, organizations are constantly transforming the ways they operate. New software is being written and deployed every day:

• Microservices
• Marketing sites
• Batch jobs
• New e-commerce features
• Mobile apps

Traditional ITAM solutions aren't tracking these custom-written applications that are the lifeblood of your organization because they aren't designed to find them.

If "who owns this?" or "did you know this was in production?" sounds familiar, you're not alone.

What if we leveraged those DevOps processes to gather crucial information about the organization’s software applications?

• Improved insight into what is being built and deployed across the software portfolio
• Efficient onboarding to Application Security tools and processes (static analysis, dynamic analysis, open source software component analysis, penetration testing, vulnerability management)
• Enhanced metrics capabilities to determine tool and process coverage as well as the organization’s Application Security maturity level

First, the Inventory Antecessor Collector Service can gather primitive inventory data (antecessors) directly from DevOps tools, such as continuous integration servers like Jenkins via the Jupiter Inventory Plugin, when the software is built and deployed.

The Inventory Management Console connects to the collector service and facilitates enrichment of the antecessor data into “gold records” representing an application.  These records are stored by the Curated Inventory Service via REST API or through the management console.