Is Your Supply Chain Safe? Dependency-Track Tutorial for Devs скачать в хорошем качестве

Is Your Supply Chain Safe? Dependency-Track Tutorial for Devs

A new vulnerability drops — do you know if your software is at risk? In this video, we show how to use CycloneDX to generate SBOMs and OWASP Dependency-Track to perform fast vulnerability scanning and supply chain risk assessment. Learn how to identify supply chain vulnerabilities, strengthen your software security, and implement secure coding practices in software development and software engineering. If you care about building secure software and managing supply chain risk, this guide will help you gain visibility and confidence in your supply chain management. Placeholder for the Supply Chain Pluralsight course: https://link.devsecforge.com/l/ps-auth Dependency-Track: https://github.com/DependencyTrack/de... Docker YAML (be careful to keep indents): version: "3.8" services: dtrack-apiserver: image: dependencytrack/apiserver:4.13.6 environment: ALPINE_DATABASE_MODE=embedded ports: "8081:8080" dtrack-frontend: image: dependencytrack/frontend:4.13.6 environment: API_BASE_URL=http://localhost:8081 ports: "8080:8080" URLs to setup API keys: https://nvd.nist.gov/developers/reque... https://github.com/settings/personal-... https://ossindex.sonatype.org/ CycloneDX repositories (navigate up to the main repo for all languages: Python : https://github.com/CycloneDX/cycloned... .Net: https://github.com/CycloneDX/cycloned... Push the SBOM to Dependency-Track: curl -X POST -H "X-Api-Key: {Your API Key}" -F "project={YourProjectId}" -F "bom=@C:\{Your BOM file Location}\bom.json" http://localhost:8081/api/v1/bom Retrieve project details: curl -X GET -H "X-Api-Key: {Your API Key}" http://localhost:8081/api/v1/project/{YourProjectId} -vv Chapters: 0:00 Are you affected by a supply chain vulnerability 0:15 Software Supply Chain Failures - SBOMs 0:47 Working with SBOMs 1:00 Installing and Using OWASP Dependency-Track 3:03 Creating an SBOM with CycloneDX for .Net 3:39 Uploading an SBOM to Dependency-Track 4:11 Using Policies with OWASP Dependency-Track 5:49 Access Project data for CI/CD Pipelines