P.3.1 Component and container choice
Control Details
Objective
Make informed third-party component and container choices.
Definition
Consider component characteristics, such as the use of secure SDLC practice, evidence of ongoing maintenance, and open vulnerabilities, as quality indicators of direct and transitive dependencies. OpenSSF Scorecard metrics may be used as an indication of the security posture of a component. Components with the least functionality reduce the attack surface. Have a deny-list that prevents malicious components from being consumed.
Assessment Questions
- What kind of approval process do you have, if any, for third-party libraries and containers included in a product?
- What do you consider when selecting a third-party component or container?
- Is considering solutions with the least functionality to reduce the attack surface part of your component selection process?
- How would the approval process handle dependencies that are no longer receiving updates?
- How do the OpenSSF Scorecard metrics factor in to decisions you make about components?
- Are you concerned when a component contains binary artifacts that cannot be easily reviewed and more easily sneak in a vulnerability?
- Do you have a Deny List to prevent the choice of vulnerable and malicious components?