Mitigating application vulnerabilities throughout the software development life cycle (SDLC) is critical—and challenging, especially as applications rely more and more on third-party, open source software (OSS). With this type of architecture, teams often don’t know exactly where vulnerabilities exist in their code, which of those vulnerabilities are actively exposed in production services, and which vulnerabilities are more critical to address than others. Fixing a vulnerability often requires taking valuable time away from developing and shipping new features in order to conduct arduous investigations and manually resolve each and every vulnerability.
To help DevOps and security teams efficiently implement and scale vulnerability management for their applications, Datadog SCA (previously Application Vulnerability Management) enables them to easily identify, prioritize, and resolve vulnerabilities in their application services.
As a comprehensive software composition analysis solution, Datadog SCA gives teams a better understanding of whether or not a vulnerability is a priority to fix. If it is, Datadog SCA provides details about where it exists, where it came from, and recommendations for how to remediate it.
Full visibility into application vulnerabilities
Traditional software composition analysis tools aim to solve the pain points of finding vulnerabilities by analyzing all the open source libraries referenced in application code. Though they offer visibility into potential security risks, they can still leave gaps in an organization’s understanding of its overall security posture. For example, their static code analysis results often do not differentiate what is exposed or active in production, which can lead to noisy false positives and ineffective prioritization. In addition, most SCA tools and remediation steps operate outside of DevOps work streams or require manual intervention, which does not scale well in many environments. This makes it more difficult for teams to effectively balance their time between reducing application security risk and meeting delivery goals.
Datadog SCA continuously monitors the libraries running in production—with the same Agent and client libraries used for Datadog APM—to provide teams with a single source of truth for vulnerabilities at the service level. As seen in the following screenshot, we can search for unique vulnerabilities that Datadog SCA flagged as either CRITICAL or HIGH priorities. Teams can easily filter this list by tags like environment, service, or team to refine their search further.
Complete context for efficient prioritization
For effective vulnerability detection, it’s essential to have a view into both pre-production and production code in the same platform. Detecting vulnerabilities early on—often referred to as “shifting left”—allows teams to avoid introducing security risks. And by also shifting right, teams can focus on the existing risks that are more likely to lead to costly outages or data breaches, instead of wasting time on issues that pose little to no risk to their applications.
Datadog SCA uses its runtime context to inform the Datadog Severity Score, which accounts for factors such as whether or not a service is running in production or actively under attack. This context makes it easier to determine which issues to focus on first. Selecting an issue will provide more information about the nature of the vulnerability and how it can be exploited by threat actors. And with Datadog SCA’s CI integration, teams can see which commit introduced the vulnerability and the affected line of code.
Improved remediation for the most critical vulnerabilities
Having Datadog SCA’s production-level context enables teams to significantly improve investigation and triage, processes that were often challenging and traditionally required manual intervention. But it’s only a part of what’s necessary for developing a simplified, cost-effective remediation process. Because open source libraries create a complex network of direct and indirect dependencies, teams also need to know how to best fix an open source vulnerability. Without this information, they may deploy a fix that doesn’t fully resolve the issue or one that creates vulnerabilities in other areas of their application.
Datadog SCA uses both code and runtime visibility to offer detailed information about a vulnerability, including multiple upgrade recommendations for resolving it. This insight enables teams to quickly determine which fix will work best for their application. As seen in the following screenshot, Datadog SCA provided two recommendations for upgrading a vulnerable library as well as outcomes for each upgrade path:
The detail view includes the appropriate references for each mitigation step, such as relevant CWEs and OWASP guidelines. This information ensures that teams can quickly resolve the vulnerabilities they’ve identified to be critical issues for their applications.
End-to-end software composition analysis with Datadog
Datadog SCA offers a comprehensive solution for proactively mitigating application security risk from vulnerable open source libraries. Datadog SCA also integrates with the larger Datadog platform, as well as a team’s static codebase. Now, teams can efficiently detect vulnerabilities found both in their pre-production and production environments and have the end-to-end context needed to prioritize the most critical issues as part of their day-to-day workflows, with limited overhead and manual intervention. To learn more, check out our SCA documentation, or get started using Datadog SCA today.
If you don’t already have a Datadog account, you can sign up for a free 14-day trial.
