OWASP Dependency Track Project

=Main=



{| style="padding: 0;margin:0;margin-top:10px;text-align:left;" |-
 * valign="top" style="border-right: 1px dotted gray;padding-right:25px;" |

OWASP Dependency-Track
OWASP Dependency-Track is a Java web application that allows organizations to document the use of third-party components across multiple applications and versions. Further, it provides automatic visibility into the use of components with known vulnerabilities.

Introduction
Over the last several years, organizations have faced a growing trend on the number of vulnerabilities reported due to the use of vulnerable third-party components. The risk involved in using third-party components is described in a paper by Jeff Williams and Arshan Dabirsiaghi titled, "The Unfortunate Reality of Insecure Libraries". This upward trend propelled the use of third-party components into a new category in the OWASP Top Ten, specifically, A9: Using Components with Known Vulnerabilities.

Description
Dependency-Track has two main goals:
 * Document the use of third-party components across multiple applications
 * Determine the use of vulnerable components across all applications

Dependency-Track incorporates a web-based asset management system specifically designed to track applications and the components that each application relies on. Many organizations have legal or new product introduction requirements that require software engineering teams to provide documentation on the use of third-party components. Dependency-Track fulfills this requirement. Using the Dependency-Track database as the sole source of evidence, the system will check the National Vulnerability Database (NVD) to determine if the components contain known vulnerabilities. Dependency-Track embeds OWASP Dependency-Check, a tool used to automatically identify components and determine if they contain known vulnerabilities.

Dependency-Track varies from Dependency-Check in how evidence is obtained. While Dependency-Check relies on files on a filesystem or build environment to scan, Dependency-Track relies on user supplied metadata about each component. These two techniques are complimentary and fulfill different requirements. Often times, an organization may rely upon both systems for a comprehensive solution.

Licensing
OWASP Dependency-Track is licensed under the GPLv3.


 * valign="top" style="padding-left:25px;width:200px;border-right: 1px dotted gray;padding-right:25px;" |

Features

 * Hierarchical view of applications and associated versions
 * Document component vendors, versions, and licenses
 * Document dependencies between applications and components
 * Provides cross-reference capabilities
 * Automatically checks the NVD
 * Visualizes known vulnerabilities in each component and application
 * Dynamically generates native Dependency-Check reports
 * Mirrors NIST data feed for faster access on Intranets
 * LDAP integration

Presentation
Coming soon

Project Leader
Steve Springett

Related Projects

 * OWASP_Dependency_Check

Ohloh

 * https://www.ohloh.net/p/dependency-track


 * valign="top" style="padding-left:25px;width:200px;" |

Quick Download
Dependency-Track is packaged as a Java Web Application Archive (WAR). Downloads will be available Q4 2014


 * Source Code

News and Events

 * [1 Feb 2014] Testing

Classifications

 * }

=FAQs=


 * Q1
 * A1


 * Q2
 * A2

=Screenshots=

= Acknowledgements =

Sponsors
Development of OWASP Dependency-Track is sponsored by Axway.

= Road Map and Getting Involved = As of October 2013, the priorities are:
 * Further integrate Dependency-Check into Dependency-Track
 * Create dashboard providing at-a-glace visibility into the use of vulnerable components
 * Auto-populate Dependency-Track database with library identification from Dependency-Check
 * Create scheduler to start Dependency-Check scans
 * Update Dependency-Check to use Dependency-Track metadata as the sole source of evidence
 * Add support for tracking end-of-life dates
 * Translate into other languages
 * Promote use of Dependency-Track

Involvement in the development and promotion of Dependency-Track is actively encouraged! You do not have to be a security expert in order to contribute. Some of the ways you can help:

Localization
Are you fluent in another language? Can you help translate Dependency-Track into that language?

Front-End Gurus
Want to provide design or an implementation for a way to visualize data? There's a lot of potential opportunities in this area. Let us know if you can help.

Feedback
Please use the Dependency-Track mailing list for feedback:
 * What you like?
 * What you don't like?
 * What could be improved?

=Project About=