OWASP Makes Significant Advancements in SBOM Effectiveness and Risk Prioritization
May 19, 2022
Adds support for exploit prediction, VEX, and non-public vulnerabilities to OWASP Dependency-Track, an SBOM analysis platform, relied on by thousands of organizations, analyzing over 200M components monthly.
Wakefield, Massachusetts May 18, 2022 (Issuewire.com) - The Open Web Application Security Project (OWASP), the worldwide nonprofit organization focused on improving the security of software, today announced significant advancements necessary to operationalize the software bills of materials pursuant to U.S. Executive Order 14028.
OWASP Dependency-Track, the leading SBOM analysis platform, introduced three new capabilities necessary to improve the efficiency and effectiveness of SBOM vulnerability management.
Statistics show that upwards of 90% of vulnerable components are not exploitable in the context of a given system or application. In response, Vulnerability Exploitability eXchange (VEX) provides a way for software suppliers to communicate exploitability information to consumers. VEX provides consumers insight into the vulnerable components that pose risk, and the ones that don't. Dependency-Track now fully supports the OWASP CycloneDX VEX format, one of two recognized VEX formats identified by the U.S. Cybersecurity and Infrastructure Security Agency (CISA). Dependency-Track is the first open platform that facilitates the creation and consumption of VEX between software suppliers and consumers.
With today's release, OWASP also announced that Dependency-Track now fully supports exploit prediction via the Exploit Prediction Scoring System (EPSS), an open data-driven effort for estimating the likelihood that software vulnerabilities will be exploited in the wild.
"VEX and EPSS are a powerful combination that allows organizations to focus on the vulnerabilities that matter when they matter," says Steve Springett, founder, and co-leader of the OWASP Dependency-Track project. "It's incredibly important that organizations have the intelligence and tools necessary to effectively respond to the next high-profile vulnerability. We're excited to bring these capabilities to Dependency-Track for the benefit of all".
Today's release also adds private vulnerability database support to Dependency-Track allowing organizations to identify vulnerabilities in internally-developed components.
Modular application development is common across enterprises. Components are often reused across multiple applications internal to an organization. These reusable components may often contain vulnerabilities identified through best practices such as static code analysis or fuzzing. With today's release, vulnerable internally-developed components are now identifiable via SBOM.
"Communicating and tracking vulnerabilities affecting internally-developed components can be a challenge, especially in larger organizations. Many processes today are primarily focused on tracking OSS risk. However, the reality is that custom code can be just as vulnerable as third-party code, with the potential of affecting large parts of an organization's application landscape" says Niklas Düster, co-leader of the OWASP Dependency-Track project. "We believe the addition of a private vulnerability database to be immensely useful, as it will allow organizations to reuse existing processes and automation to drive remediation efforts".
Visit https://docs.dependencytrack.org/usage/executive-order-14028/ to learn how OWASP Dependency-Track helps organizations and governments support U.S. Executive Order 14028.
Visit https://dependencytrack.org/ to get started.
Source :OWASP
This article was originally published by IssueWire. Read the original article here.
More News
Hotel Review: British Colonial Nassau, The Bahamas
Few downtown hotels come with a private beach, James Bond history and cruise ships turning outside your window. British Colonial Nassau adds refreshed rooms, pools and Bahamian flavor to the mix. The post Hotel Review: British Colonial Nassau, The Bahamas appeared first on Business Traveller.
Kenya confirms 2nd case of Ebola in relative of patient who died earlier this month
Kenya's Health Ministry confirmed the country's second Ebola case Wednesday, saying a relative of the man who died two days after arriving from Congo had tested positive while in quarantine.
Restaurant Review: Quaglino’s, Mayfair – A London Icon Reinvents Itself for a New Era
Quaglino’s revives its 1990s glamour with refined dining, live music and theatrical touches at its legendary St James’s restaurant. The post Restaurant Review: Quaglino’s, Mayfair – A London Icon Reinvents Itself for a New Era appeared first on Business Traveller.
Breeze Airways Launches 22 New Routes and Four Destinations for 2027
Spirit left a sizeable hole in Myrtle Beach. Breeze is wasting little time filling it, adding 11 routes there while turning Tampa into an increasingly important springboard for international flying. The post Breeze Airways Launches 22 New Routes and Four Destinations for 2027 appeared first on Business Traveller.
Survey of Alberta doctors suggests more than half would stop practising if province separates
Hundreds of physicians would not practise in Alberta if the province leaves Confederation, a survey by the organization that represents doctors in the province indicates.
United Makes MileagePlus Premier 1K Status Spend-Only in 2027
Opinion: United still calls MileagePlus a frequent-flyer program, but frequency is about to matter considerably less. From 2027, spending drives status—and Premier 1K gets another $4,000 more expensive. The post United Makes MileagePlus Premier 1K Status Spend-Only in 2027 appeared first on Business Traveller.
National Dessert Day Is October 14 — Pick Cities And Celebrate By Making Something Delicious
Travel AND dessert; what could be better? View Entire Post ›
IATA and World Sustainable Hospitality Alliance to Collaborate on Sustainable Hotel Procurement
The International Air Transport Association (IATA) and the World Sustainable Hospitality Alliance (WSHA) have agreed to strengthen alignment on sustainability between the airline and hospitality sectors. The agreement, signed at the World Sustainability Symposium, will have an initial focus on the procurement of hotel services by airlines. Airlines and hotels face many similar environmental, social, and governance challenges. These include responsible procurement, environmental management, social responsibility, supply chain performance, and increasingly complex sustainability measurement and reporting expectations.
The Best New Hotels Around the World for October 2026
The hotel doors to breeze through this month – from a spa hotel in Phoenix to a Yorkshire Dales' coaching inn. The post The Best New Hotels Around the World for October 2026 appeared first on Business Traveller.
Hotel Debüts: In diesen Ländern feiern internationale Hotelmarken Premiere
Wir stellen Ihnen neun spannende Markteintritte vor. The post Hotel Debüts: In diesen Ländern feiern internationale Hotelmarken Premiere appeared first on Business Traveller.
Attendee experience tops 2027 meetings priorities despite rising costs and geopolitical risks: Amex GBT
Attendee experience remains the top priority for meetings professionals globally in 2027, even as rising costs and geopolitical uncertainty reshape event planning, according to American Express Global Business Travel's 2027 Global Meetings and Events Forecast. The report finds that 91 per cent expect spending to increase, while 79 per cent already apply risk management practices to all or most meetings.
'Oscars of fish and chip shops' unveils 10 finalists battling to be crowned Britain's best chippy
The National Fish and Chip Awards 2027 has announced its top 10 contenders for Restaurant of the Year. Is your local favourite among the contenders for the prestigious title?
YOUR NEWS, OUR NETWORK.
Do you have Great News you want to tell the world?
Be it updates about your business or your community, you can make sure that it’s heard by submitting your story to our network reaching hundreds of news sites across 6 verticals.