Techniques and tools designed to mitigate risks from application vulnerabilities in third-party code, such as libraries and dependencies.

Techniques and tools designed to mitigate risks from application vulnerabilities in third-party code, such as libraries and dependencies.

• A. software bill of materials (SBOM)
• B. package monitoring
• C. software composition analysis (SCA)
• D. threat feeds

Answer: (D)

Software Composition Analysis focuses on identifying every open-source and third-party library your application uses, and then analyzing those components against vulnerability data and licensing information to determine risk and prioritise remediation. This directly addresses the need to mitigate risks from third‑party code, because the core challenge is knowing what components are present, which versions are vulnerable, and what fixes or replacements are available. SCA typically relies on an SBOM (a detailed inventory of components) as input and combines it with vulnerability databases to produce actionable findings, such as which components are affected by specific CVEs and recommended upgrade paths. An SBOM by itself lists what’s in the software but doesn’t assess risk or tell you how to remediate. Package monitoring tracks when new advisories appear for components you already use, but doesn’t automatically map those advisories to your exact dependency tree or prioritize fixes across an entire codebase. Threat feeds provide vulnerability information, which is valuable context, but they are not a dedicated tool or process for assessing and managing third‑party risk within an application; they need to be integrated into a broader SCA workflow to be effective.

Software Composition Analysis focuses on identifying every open-source and third-party library your application uses, and then analyzing those components against vulnerability data and licensing information to determine risk and prioritise remediation. This directly addresses the need to mitigate risks from third‑party code, because the core challenge is knowing what components are present, which versions are vulnerable, and what fixes or replacements are available. SCA typically relies on an SBOM (a detailed inventory of components) as input and combines it with vulnerability databases to produce actionable findings, such as which components are affected by specific CVEs and recommended upgrade paths.

An SBOM by itself lists what’s in the software but doesn’t assess risk or tell you how to remediate. Package monitoring tracks when new advisories appear for components you already use, but doesn’t automatically map those advisories to your exact dependency tree or prioritize fixes across an entire codebase. Threat feeds provide vulnerability information, which is valuable context, but they are not a dedicated tool or process for assessing and managing third‑party risk within an application; they need to be integrated into a broader SCA workflow to be effective.