May 2024 Summaries

Modern applications heavily rely on open-source components, with transitive dependencies—those indirectly imported through direct dependencies—forming a significant part of the codebase. These dependencies require careful management due to their potential security risks, which can impact software regardless of their position in the dependency chain. Understanding and managing these risks involves reachability analysis to determine if vulnerabilities in transitive dependencies are exploitable within the application. Tools like Endor Labs provide solutions by modeling dependencies as a graph to identify which direct dependencies require updates to address vulnerabilities in transitive dependencies, thus avoiding the complexities of direct transitive updates. Additionally, software composition analysis (SCA) tools are essential for detecting and prioritizing such vulnerabilities, offering features like accurate inventory, prioritization of risks, and identification of supply chain attacks to enhance software security and compliance.

GitHub Actions is a widely adopted CI/CD platform that facilitates automation for users managing source code repositories on GitHub, offering pre-built Actions that simplify workflows by providing reusable components. These Actions, often open-source and akin to application dependencies, come with both advantages and security risks, necessitating visibility, risk assessment, and dependency management to ensure the integrity of CI/CD pipelines. Addressing these risks involves several strategies, such as hardening workflow configurations, implementing stringent environment controls, and managing dependencies by pinning versions or maintaining forks for updates. Endor Labs provides tools to enhance security by analyzing risks associated with GitHub Actions and enforcing policies to safeguard against vulnerabilities, enabling organizations to maintain secure and efficient CI/CD operations.

The Digital Operational Resilience Act (DORA), approved by the European Parliament and effective from January 17, 2025, aims to standardize ICT operational risk management across the EU financial sector to enhance digital resilience against societal and economic disruptions. DORA mandates comprehensive ICT risk management strategies, including maintaining and testing security policies, monitoring technical controls, and implementing crisis communication plans. Financial institutions and third-party ICT service providers must comply with these requirements, particularly concerning open-source software (OSS) vulnerabilities. DORA emphasizes the need for robust vulnerability and patch management and thorough testing of ICT systems, including source code reviews and security testing. As part of achieving compliance, organizations should adopt best practices like identifying OSS components, assessing risks, scanning for vulnerabilities, and prioritizing remediation efforts. Regulatory Technical Standards (RTS) are being developed to provide specific technical guidelines for effective DORA implementation. Tools like Software Composition Analysis (SCA) are recommended to help organizations manage OSS risks, document software inventories, and ensure compliance with both DORA and related standards such as PCI DSS.

A strategic reseller partnership has been formed between Endor Labs and GuidePoint Security to enhance cybersecurity solutions, focusing on improving the security of the software development lifecycle. This collaboration aims to provide developer-centric tools that address the challenges posed by existing Software Composition Analysis (SCA) and Application Security Posture Management (ASPM) tools, which often overwhelm teams with uncontextualized data and false positive alerts. Endor Labs' approach, which reduces noise by 80% and offers actionable insights, is poised to become a key player as SCA is expected to surpass Dynamic Application Security Testing (DAST) by 2026. By building a complete call graph for applications, it helps developers concentrate on the most critical vulnerabilities, addressing the fact that only a small fraction of open-source code is actually used in applications. This partnership also aims to improve open-source code security, CI/CD pipeline security, and compliance with software supply chain security standards. GuidePoint Security provides expertise to help organizations optimize their cybersecurity posture, having already supported numerous Fortune 500 companies and U.S. government agencies.

Mobile apps face unique security challenges compared to desktop software due to their diverse operating systems, hardware configurations, and continuous connectivity. These challenges necessitate robust data protection measures and secure gaming experiences for players, particularly in mobile gaming. An estimated 80% of code in modern applications is open-source software (OSS), making it a significant attack vector, thereby emphasizing the importance of selecting safe OSS packages. The Android Security Bulletin focuses on platform issues, while OWASP provides a comprehensive classification of mobile risks. Notable vulnerabilities include those in the OkHttp and Bouncy Castle libraries, affecting certificate pinning and TLS security, respectively. Kotlin's function-level reachability analysis helps prioritize vulnerabilities by determining their impact on applications, a feature now available in Endor Labs. For iOS apps, common risks include Denial of Service, Path Traversal, and Arbitrary Code Execution, with Endor Labs supporting Software Composition Analysis (SCA) using CocoaPods. Swift's ecosystem has relatively fewer known vulnerabilities, allowing developers to focus on prioritizing and improving security measures. Endor Labs offers tools for selecting better open source dependencies, defending against OWASP risks, securing repositories and CI/CD pipelines, and ensuring compliance with security standards.

Endor Labs, showcased at BlackHat 2026 in Las Vegas, offers a comprehensive solution for software supply chain security by facilitating the secure adoption of open-source software, ensuring code trustworthiness, and complying with industry standards. In a 30-minute on-demand webinar, Matt Brown elaborates on how Endor Labs supports these initiatives, focusing on preventing secret leaks and enhancing compliance through CI/CD integration and software bill of materials (SBOM) generation. The platform is utilized by companies like Astronomer and Rubrik for various application security tasks, including software composition analysis (SCA), malware detection, container scanning, and secret detection, ultimately helping them meet stringent service level agreements (SLAs) and modernize their application security practices.

The article is part of a ten-part series by Station 9 at Endor Labs, focused on the top risks associated with Open Source Software (OSS) dependencies, specifically OSS-RISK-1: Known Vulnerabilities. It discusses how known vulnerabilities are publicized security flaws that can exist in both open source and private software packages, often disclosed through the Common Vulnerabilities and Exposures (CVE) program. The article highlights the importance of promptly patching dependencies once a fix is released to prevent potential breaches, as demonstrated by the Equifax incident where failure to update Apache Struts led to a massive data breach. The article also explores methods for assessing vulnerability exposure, including Common Vulnerability Scoring System (CVSS), Exploit Prediction Scoring System (EPSS), and Reachability Analysis, emphasizing the importance of using reliable data sources such as NVD, GitHub Advisories, and OSV. Furthermore, it discusses the importance of prioritizing remediation efforts based on factors like reachability, fix availability, and exploitation probability, using a case study with Endor Labs to illustrate the effectiveness of these strategies in reducing security debt and improving vulnerability management.

Endor Labs provides a private, seamless, and simple solution for artifact signing, serving as an alternative to Sigstore for organizations needing a private transparency log without the complexity of deploying and managing extensive infrastructure. Their keyless, identity-based artifact signing system leverages existing identity infrastructure, requiring no new infrastructure for deployment and maintenance, and integrates quickly into CI/CD pipelines and other environments. The system uses an identity-based or keyless approach, primarily relying on OpenID Connect (OIDC) authentication to issue short-lived certificates that bind ephemeral keys to OIDC identities. To ensure security and compliance, Endor Labs has decided against using tags for container images, opting instead for SHA256 digests to uniquely identify artifacts, thus eliminating the need for additional artifact registry access privileges. The infrastructure supports signature verification and revocation, ensuring signed artifacts maintain their integrity and can be verified against a trusted certificate authority. Endor Labs integrates seamlessly with tools like GitHub Actions, enhancing CI/CD security programs by offering visibility into pipeline tools, managing repository security posture, and providing artifact signing capabilities, all available in their free trial to explore their Software Supply Chain Security platform.

PCI DSS version 4.0 introduces a new requirement, effective March 31, 2025, that necessitates the management of all vulnerabilities, not just those deemed high-risk or critical, through a comprehensive risk analysis. This change emphasizes that all vulnerabilities present potential security risks and should be addressed based on their specific impact on an organization's environment. The article highlights the challenges application security teams face in achieving compliance, particularly with the management of open-source software (OSS) vulnerabilities, which constitute a significant portion of modern codebases. Static Application Security Testing (SAST) and Software Composition Analysis (SCA) tools are commonly used to identify these vulnerabilities, but they often produce excessive noise, complicating compliance efforts. The solution lies in employing reachability-based SCA tools that provide accurate dependency inventories and prioritize vulnerabilities based on their actual threat level. Additionally, organizations are encouraged to implement strategies such as Open Source Program Offices (OSPOs) to govern OSS selection and use scoring systems to evaluate package health, ultimately reducing the volume of vulnerabilities and easing compliance with PCI DSS requirements.