This site is the archived OWASP Foundation Wiki and is no longer accepting Account Requests.
To view the new OWASP Foundation website, please visit https://owasp.org
Difference between revisions of "OWASP Dependency Track Project"
m (→Release Notes) |
m (→Acknowledgements) |
||
| Line 114: | Line 114: | ||
= Acknowledgements = | = Acknowledgements = | ||
| − | This project would not be possible without the existence of the | + | This project would not be possible without the existence of the [[OWASP_Dependency_Check]] project. A special thanks to Jeremy Long and the Dependency-Check core team for their hard work. |
==Dependency-Track Core Team== | ==Dependency-Track Core Team== | ||
Revision as of 16:02, 29 November 2014
OWASP Dependency-TrackOWASP Dependency-Track is a Java web application that allows organizations to document the use of third-party components across multiple applications and versions. Further, it provides automatic visibility into the use of components with known vulnerabilities. IntroductionOver the last several years, organizations have faced a growing trend on the number of vulnerabilities reported due to the use of vulnerable third-party components. The risk involved in using third-party components is described in a paper by Jeff Williams and Arshan Dabirsiaghi titled, "The Unfortunate Reality of Insecure Libraries". This upward trend propelled the use of third-party components into a new category in the OWASP Top Ten, specifically, A9: Using Components with Known Vulnerabilities. DescriptionDependency-Track has two main goals:
Dependency-Track incorporates a web-based asset management system specifically designed to track applications and the components that each application relies on. Many organizations have legal or new product introduction requirements that require software engineering teams to provide documentation on the use of third-party components. Dependency-Track fulfills this requirement. Using the Dependency-Track database as the sole source of evidence, the system will check the National Vulnerability Database (NVD) to determine if the components contain known vulnerabilities. Dependency-Track embeds OWASP Dependency-Check, a tool used to automatically identify components and determine if they contain known vulnerabilities. Dependency-Track varies from Dependency-Check in how evidence is obtained. While Dependency-Check relies on files on a filesystem or build environment to scan, Dependency-Track relies on user supplied metadata about each component. These two techniques are complimentary and fulfill different requirements. Often times, an organization may rely upon both systems for a comprehensive solution. LicensingOWASP Dependency-Track is licensed under the GPLv3.
|
Features
PresentationComing soon
Project LeaderSteve Springett
Related ProjectsOhloh |
Quick DownloadDependency-Track is packaged as a Java Web Application Archive (WAR). Downloads will be available Q4 2014
News and Events
Classifications
| |||||
- What are the system requirements?
- Dependency-Track requires Java 7 or higher and can run on any Servlet container such as Tomcat or Jetty.
- What type of database is used?
- Dependency-Track embeds the H2 database engine. A standalone database server may optionally be used.
- How often is the NVD data updated?
- The NVD update is handled by Dependency-Check. Upon starting the servlet container for the first time, the entire contents of the NVD data feed is downloaded. Once downloaded, the system will attempt a delta update every 24 hours.
- What is the NVD mirror feature?
- For organizations that run Dependency-Check, it is possible to specify an alternate URL for the NIST/NVD data. This allows organizations with many Dependency-Check instances to take advantage of an internal mirror for faster access. The NIST/NVD data feed can be used by specifying http://HOSTNAME/CONTEXT/nist/FILENAME. For example: http://localhost:8080/dtrack/nist/nvdcve-2.0-2002.xml.gz. The NVD mirror is automatically updated every 24 hours.
Login screen
List of applications
Dependencies in an application version
List of libraries
Creating a new library
Search for library usage across all applications
This project would not be possible without the existence of the OWASP_Dependency_Check project. A special thanks to Jeremy Long and the Dependency-Check core team for their hard work.
Dependency-Track Core Team
- Steve Springett
- Nikhil Chitlur Navakiran
Sponsors
Development of OWASP Dependency-Track sponsored in part by Axway.
As of December 2014, the priorities are:
- Complete initial public release (v1.1)
- Create dashboard providing at-a-glace visibility into the use of vulnerable components
- Auto-populate Dependency-Track database with library identification from Dependency-Check
- Add support for tracking end-of-life dates
- Translate into other languages
- Promote use of Dependency-Track
Involvement in the development and promotion of Dependency-Track is actively encouraged! You do not have to be a security expert in order to contribute. Some of the ways you can help:
Localization
Are you fluent in another language? Can you help translate Dependency-Track into that language?
Front-End Gurus
Want to provide design or an implementation for a way to visualize data? There's a lot of potential opportunities in this area. Let us know if you can help.
Feedback
Please use the Dependency-Track mailing list for feedback:
- What you like?
- What you don't like?
- What could be improved?
- v1.1.0
- Initial public release. Scheduled to be released in December 2014.
- v1.0.0
- Initial proof-of-concept version to prove project viability and technical feasibility. This was a restricted availability release.
| PROJECT INFO What does this OWASP project offer you? |
RELEASE(S) INFO What releases are available for this project? | |||||||||||||||||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
| |||||||||||||||||||||||||||||||||||||||
