Análisis de dependencias en código como servicio. Presentación de DeepTracy + Patton

1. Scan your
project
dependencies
to spot
vulnerabilities
@alejandrogr
@iknite
@pixeliko
@sergiodfdez

2. 1.
THE
PROBLE
M

3. DEPEND
ENCIES

4. Difficulty
Level
Components
Life
Impact

5. Am I vulnerable to known
vulnerabilities?
- Don’t know all component
versions.
- Any component out of date.
- We don’t scan regular.
How do I prevent this?
- Remove unused
components/features.
- Continuously inventory the
versions.
- Continuously monitoring
vulnerabilities.

6. VULNERA
BILITIES
DATABAS
E

7. STANDARD
FOR
INFORMATIO
N SECURITY
NAMES

10. > npm ls
> mvn
dependency:tree

11. RegEx
HELL

12. Continuo
us
Security
ecosyste

13. 2.
DEEPTR
ACY

14. OPEN SOURCE
NOTIFY UPDATES
PIPELINES
AS A SERVICE
PRIVATE
REPOSITORIES
ON PREMISE

17. COREAPI
WORK
ERS

18. DASH

23. PATT
ON(n.) Package Vulnerabilities extraction.
(p.) Pat Patton was the original partner of Dick Tracy when
Tracy first started on the city police force. He had light hair and
small, dark eyes.

24. ColLaborative
Reinforcement

25. Command-line
Interface

26. deeptracy.slack.com
github.com/BBVA/deeptracy
github.com/BBVA/patton
@alejandrogr
@iknite
@pixeliko
@sergiodfdez