Know Your Dependencies: A Guide to Automating Dependency Assurance

The importance of understanding and assuring the trustworthiness of external dependencies in software applications

• Modern software components contain a selection of external dependencies whose provenance is unknown
• Assuring the trustworthiness of dependencies is often ignored by organizations and their engineering teams
• Efficient, automated pipelines can be used to audit dependencies for vulnerabilities and license obligations, assess them against the organization’s security policies, and ultimately provide the ability to control which dependencies can be used and deployed within the organization

Software engineers lack knowledge about the dependencies they use within their software applications, including indirect transient dependencies. Jetstack cert manager products have around 1500 dependencies, of which only about 30 are direct. This makes it impractical to understand and have much knowledge about such a vast array of dependencies in typical applications.

It is a truth universally acknowledged that almost every modern software component contains a selection of external dependencies whose provenance is unknown. Another truth is that no dependency should be trusted until proven trustworthy. This second truth, though, is often ignored by organisations and their engineering teams, who argue that assuring the trustworthiness of dependencies is too complex, too time-consuming and has a detrimental impact on development velocity. This talk will describe how Jetstack has worked with several clients in the financial services and defence sectors to help them develop dependency assurance mechanisms and processes that allow greater visibility and insight into the dependencies used and their impact on the clients’ risk and security postures. The audience will learn how modern tooling and practices can be used to create efficient, automated pipelines that audit dependencies for vulnerabilities and licence obligations, assess them against the organisation’s security policies and ultimately provide the ability to control which dependencies can be used and deployed within the organisation.