SCA (software composition analysis)
SCA · software composition analysis · dependency scanning · dependency analysis · open source scanning · vulnerable dependencies · analyse des dépendances
Analysis that lists the open source and third-party libraries an application uses, to flag those with known vulnerabilities or licence issues.
In practice
A modern application is mostly made of code it did not write: libraries, frameworks, container images. An SCA tool reads the dependency files (package-lock.json, pom.xml, composer.lock and so on), indirect dependencies included, and matches them against vulnerability databases (CVE, vendor advisories). The best tools show whether the vulnerable code is actually called and suggest the fixed version. SCA also feeds the SBOM, the component inventory that the Cyber Resilience Act requires from manufacturers.
Real case: in 2017, Equifax had not patched a critical flaw in the open source Apache Struts framework, reported in March; attackers exploited it on its online dispute portal and stole the data of around 147 million people (source: FTC, July 2019).
How to protect yourself
- Scan dependencies on every build and block critical vulnerabilities.
- Automate dependency updates, backed by tests.
- Remove unused libraries: fewer components, fewer flaws.
