The Book of DevOps Patterns : #2 -Testing dependencies

The Book of DevOps Patterns is a long series of patterns used by DevOps. Each story is introduced in a synthetic way by going to the essential.

Pattern #2 -Testing dependencies

Some applications use open source software. These softwares have security issues and bugs. These release dependencies must therefore be tested.
It is important to understand which version of each dependency is used: the latest version should not be applied systematically without control. Indeed, the different versions of software dependencies should be tested and validated. This is to ensure that they do not introduce any vulnerability in your software.
This kind of vulnerability is listed in the OWASP 2013 Top 10: “A9 — Use of Components with Known Vulnerabilities”.
It is therefore important to use a vulnerability database such as CVE (Common Vulnerabilities and Exposures — https://cve.mitre.org/) in order to identify the vulnerabilities of the dependencies used. There are tools that do these checks automatically, such as OAWSP’s Dependency-Check.

Get the Medium app

A button that says 'Download on the App Store', and if clicked it will lead you to the iOS App store
A button that says 'Get it on, Google Play', and if clicked it will lead you to the Google Play store