APPS-4 Dependency Vulnerability Monitoring

Estimated reading: 2 minutes 1563 views

What is APPS-4 Dependency Vulnerability Monitoring Control?

Dependency vulnerability monitoring helps automatically find security vulnerabilities in any third-party software dependencies used while developing and testing your applications. As organizations increase their usage of third-party software, it becomes more important to track and monitor any vulnerabilities that may arise from these relationships.

Available tools in the marketplace

The following listing is “crowdsourced” from our customer base or from external research. TrustCloud does not personally recommend any of the tools below, as we haven’t used them.

Vulnerability Scanning Tools
Snyk
Gitlab Dependency scanning –
GitHub Dependabot –

Available templates

TrustCloud has a curated list of templates, internally or externally sourced, to help you get started. Click on the link for a downloadable version.

  • N/A: No template recommendation is made for this control

Control implementation

To implement this control,

  1. Install a vulnerability monitoring tool to monitor for third-party dependencies.
    1. The tool must be configured to run continuously or on a frequent schedule (the schedule is up to each company to determine).
    2. The tool must be configured to send a notification or alert when issues are found.
  2. Implement a formal and repeatable way to resolve any issues identified. The issues must be resolved promptly (timeliness is up to each organization to define).

What evidence do auditors look for?

Most auditors, at a minimum, are looking for the below-suggested action:

  1. Provide screenshots of the tool’s settings screen(s), showing that it is configured to check dependencies across your codebase.
  2. Provide a remediation ticket or document outlining issues found through the tool that shows that actions were taken to remediate the issue.

Evidence example

For the suggested action, an example is provided below:

  1. Provide screenshots of the tool’s settings screen(s), showing that it is configured to continuously or frequently analyze your code.
    The following screenshot shows an example of a tool.
    APPS 4 Dependency Vulnerability Monitoring 01
  2. Provide a remediation ticket or document outlining issues found through the tool that shows that actions were taken to remediate the issue.
    The following screenshot shows an example of remediation configuration (This can include more detailed evidence of remediation)APPS 4 Dependency Vulnerability Monitoring 02

Join the conversation

ON THIS PAGE
SHARE THIS PAGE

SUBSCRIBE
FlightSchool
OR