COFE Event 27 Dec 2023 - Reachability Analysis Demo

Upgrading dependencies in a software project can be a complex and time-consuming task due to several challenges. Here's a breakdown of the reasons why upgrading dependencies can be difficult, along with ideas for prioritizing upgrades and a methodology for reachability analysis.
Challenges in Upgrading Dependencies:
1. **Volume of Libraries**: Projects often use a large number of libraries, each with its own release cycle and dependencies. Keeping up with all the updates can be overwhelming.
2. **Compatibility Issues**: Upgrading one library might necessitate upgrading others or might not be compatible with other parts of the system. The phrase "We cannot upgrade a library because of ________" often refers to issues like breaking changes, API modifications, or dependencies that require a specific version of a library.
3. **Testing Overhead**: Developers need to thoroughly test the application after upgrading libraries to ensure that changes do not break the application. This can be time-consuming, especially for large applications or when there are significant changes in the library.
Ideas for Prioritizing Dependency Upgrades:
1. **Direct vs Transitive Dependencies**: Focus on direct dependencies first, as these are the ones your codebase explicitly calls and relies on. Transitive dependencies (dependencies of your dependencies) can be considered in a secondary wave or when they are known to have critical issues.
2. **Business Value of the Application**: Prioritize upgrades for applications that are critical to business operations or have a high impact on users. Applications that directly generate revenue or are mission-critical should be kept up to date more rigorously.
3. **External vs Internal Applications**: External-facing applications might be prioritized for upgrades due to the higher risk of exposure to security vulnerabilities. Internal applications might have some leeway; however, they should not be neglected.
4. **Risk Assessment**: Use a formula like Risk = Probability x Impact to assess the risk of not upgrading a dependency. Consider both the exploitability of the outdated dependency (Probability) and the potential damage it could cause (Impact).
Reachability Analysis for Prioritizing Vulnerabilities:
Reachability analysis is a method to understand and prioritize vulnerabilities based on the actual use and reachability of vulnerable code paths in your application.
**Dependency Graph from Manifests**: Start by creating a graph of all dependencies as declared in your project's manifest files (like package.json, requirements.txt, etc.).
**Code Scan**: Perform a code scan to identify which dependencies are actually used in the code. This helps to distinguish between what's declared and what's effectively used, focusing on real direct dependencies.
**Create a Dependency Graph**: Generate a comprehensive graph that includes all the dependencies and their interconnections.
**Traverse the Graph for Function Calls**: Analyze the graph to understand the chain of function calls. This helps to identify if vulnerable functions are ever called in the application's normal operation.
This approach helps in understanding not just the presence of a vulnerable library but its context and usage in the application, allowing for more informed decision-making on whether and how urgently an upgrade is needed. By combining a strategic prioritization framework with a technical reachability analysis, organizations can more effectively manage their dependency upgrades, focusing effort where it's most needed to maintain both functionality and security.
Subscribe to our Blogs - safedep.substa...
Know About Safedep - safedep.io
Try out our Open Source Initiative - github.com/saf...