Software Composition Analysis (SCA)
Software Composition Analysis (SCA) empowers you with information on open source software used in source code that has the potential to expose your organization to critical vulnerabilities, license compliance or legal and compliance issues. On Prisma Cloud, you can view the latest contextualized SCA information from continuous scans across all your integration integrations of IDE, VCS repositories and CI/CD pipelines.
Open source software is a prebuilt code available publicly for direct use, modification or enhancement into any code. To use an open source software in your environment often requires you to use an open source package manager, which is a combination of files and metadata that help you describe how the code should be used. Parallelly, to ensure better performance, stability and security,open source package managers are continuously updated to the latest version. Once the open source code definition is set in your code, the scans begin at the Development lifecycle, where every package manager file in your integration is scanned automatically for any security violation or vulnerabilities before deploying it to development pipelines. All scan results are then analyzed using Intelligence Stream, an in house package vulnerability database to give you information on security vulnerabilities found in the open source package manager that are viewable on the Prisma console.
The SCA vulnerabilities scan results include:
Bill of Materials (BOM)
Bill of materials (BOM) or software bill of materials (SBOM) is a contextualized inventory of open source packages and third-party components your source code utilizes. SBOM includes information on versions, licenses and vulnerabilities of the components that comprise your application’s source code, helping you make legal and risk assessments of your application. On the Prisma Cloud console you can view the SBOM reports on Application Security > SBOM where the reports are specific to runtime resources.
License compliance
For every available open source software, there are licenses that define how to use, modify and enhance the open source code. The license grants user permissions and rights to repurpose the code into another code. Prisma Cloud scans for compliant licenses using industry standards to identify any restrictive licenses as violations. There are two ways you can identify license vulnerabilities on Prisma Cloud.
Firstly, during code development you can run a Checkov scan and secondly, on the Prisma Cloud console from Application Security > Projects. On the console using the contextualized information for license issues on Resource Explorer you can make an informed decision to suppress the violation. For more information see Licensing in Software Composition Analysis (SCA).
Remediation
You can automatically remediate SCA open source package vulnerabilities on the Prisma Cloud console by bumping a package version of direct and sub-dependent packages by creating a pull request to your VCS. A package bump suggestion includes the minimum version of the root package that remediates both direct dependency and sub-dependency vulnerabilities.
The vulnerabilities identified across the scan results are seen across multiple sections of the Prisma Cloud console and are contextualized to help you with vulnerability management. See Monitor and Manage Code Build for more information.
Software Composition Analysis
For each vulnerability identified in an SCA scan, Prisma Cloud contextualizes it as a Common Vulnerabilities and Exposures (CVE) for open source package managers. CVE is publicly available information on cybersecurity vulnerabilities and exposures often listed by Mitre corporation. Each CVE has an ID that uniquely identifies one vulnerability from the list. In addition to the CVE ID, on Prisma Cloud you can view CVSS (Common Vulnerability Scoring System), an open framework for calculating the severity of software vulnerabilities defined by NIST. With CVE ID, CVSS, package name and version, Prisma Cloud also gives you Risk Factors to help you with your vulnerability management that is associated with each scanned package and have seven defined categories.
Mitigate Runtime Vulnerabilities at Source
Prisma Cloud’s image-to-repository tracing capabilities allow you to contextualize CVE vulnerabilities detected in your runtime environment within Cloud Application Security (CAS), as well as to identify their source in the codebase. This enables you to mitigate these vulnerabilities at source, preventing them from impacting your runtime environment.
On the Application Security > Projects page, you can leverage the Vulnerability Risk Factors filter to trace CVEs detected in runtime back to your codebase. This allows you to focus and mitigate vulnerabilities at their source, preventing them from reaching runtime environments. The following runtime risk factors are available to filter vulnerabilities in CAS.
Attack complexity
This helps you understand if the vulnerability is easily exploitable
DoS
Component is vulnerable to denial of service attacks, such as buffer overflow attacks, and ICMP floods. The risk is categorized as high or low based on impact
Attack vector
Vulnerability is remotely exploitable. The vulnerable component is bound to the network, and the attacker’s path is through the network
Remote execution
Vulnerability can be exploited to run arbitrary code
Exploit POC
Code and procedures to exploit the vulnerability are publicly available
Exploit in the Wild
Exploit attempts of this vulnerability that have been seen in the wild. All vulnerabilities are from the CISA KEV Catalog.
Package in Runtime
The traced container image and the vulnerable package share a "package in use" risk factor (loaded to memory) identified by CWP
Repository in Runtime
The traced container image used to build the application is accessible within the runtime environment
Manifest in Runtime
The presence of a package manager file (such as package.json) is detected within the runtime environment
For more information on runtime risk factors, refer to Vulnerabiity Explorer.
You can view the SCA scan results on:
Integrations
You can monitor SCA scan results in your development lifecycle through integrations of development environments (IDEs) where scan results are in line with package manager files as you code, helping you commit secure code before deployment. In version control system (VCS) integrations with GitHub and GitLab, vulnerability findings are accessible in pull requests that include information on the CVE ID, severity, CVSS score and the minimum package version to remediate the vulnerability.
Checkov
During your code development or through a CI/CD pipeline you can identify SCA violations in vulnerabilities and licenses by running Checkov. By running Checkov you can natively scan all your files or choose to specifically identify SCA violations by using
--framework sca_package. In this example, you see the scan result of a Checkov run for an SCA scan.
Projects
During periodic scans on Prisma Cloud the SCA scan results are updated and contextualized for monitoring and remediating package vulnerabilities identified in the source code on Application Security > Projects and then select Vulnerabilities view to see results exclusively for SCA scan results.
The contextualized information for each package is available on the Resource Explorer. The scan results outline direct and sub-dependency packages in the source code to help you make informed decisions for each type of package. In this example, you see the scan result of a direct dependency package with contextualized information of a package vulnerability in Resource Explorer > Issues.
In this example, you see the scan result of a sub-dependency package with contextualized information of a package vulnerability in Resource Explorer > Issues.
Remediate vulnerabilities for SCA
Remediation for SCA scan results can be performed on the console from Projects.
For identified package vulnerabilities, especially packages with direct dependencies, Prisma Cloud provides an automated fix solution for bumping the package version. Additionally, if there are vulnerabilities found in sub-dependency packages, Prisma Cloud offers a solution to bump the root version of the package to the nearest secure version, irrespective of the source of vulnerability.
Access Application Security > Projects and then select Vulnerabilities.
Select a policy to remediate.
On the side panel select Issues and then Fix to remediate a policy violation.
You can choose to remediate a single package or all dependent packages. To to fix individual packages, select fix in corresponding to the package.
Optionally select Fix all to remediate all packages where the policy violation exists.
Select Submit to implement the remediation fixes.
Suppress vulnerabilities for SCA
Every identified vulnerability in an SCA scan can be suppressed on the console from Projects. Suppressing a vulnerability absolves the next scan from identifying it through a suppression rule. The suppression rule must have a definitive explanation indicating the non-conformance to be not problematic.
Access Application Security > Projects and then select Vulnerabilities.
Select a vulnerability to suppress.
On the side panel select Issues.
Select Suppress.
Add a justification as a definitive explanation for suppressing the specific vulnerability.
Optionally you can add an Expiration Time.
Select Suppress by. You can choose either CVE or CVEs in Accounts.
CVE: You will be suppressing alerts related to specific known vulnerabilities. This approach allows you to address alerts associated with a particular vulnerability, providing a targeted response to potential security risks.
CVEs in Accounts: You will be suppressing alerts across multiple accounts that share common vulnerabilities. By choosing this option, you will suppress alerts related to specific vulnerabilities that may be affecting multiple accounts within your system.
Select Save to enable suppression.
Supported Package Managers for Software Composition Analysis (SCA)
For SCA scans, Prisma Cloud supports a list of Package Managers across multiple languages. Refer to Supported Package Managers for Software Composition Analysis (SCA) for more information.
Troubleshooting
To troubleshoot SCA scan issues, refer to Troubleshoot Software Composition Analysis (SCA) Issues.
Last updated
Was this helpful?