What Is Software Composition Analysis (SCA)?

How SCA works

SCA works by comprehensively scanning application codebases and listing components or dependencies that are known to originate from external sources – such as a snippet of code that was borrowed from an open source repository or a third-party software library that an application uses. In addition to listing components, SCA tools often highlight any components that are known to be subject to a security vulnerability, as well as those that are governed by specific software licenses.

Traditionally, most SCA scans produced lists of software components, with each tool formatting the list in a different way. Over the past several years, however, it has become common for SCA tools to generate a Software Bill of Materials (SBOM). SBOMs are a way of listing and describing the software components within an application using formatting structures that are easy to share between different tools, and that lend themselves well to automated analysis.

SCA is typically most effective when scanning tools have access to raw application source code, since it’s easiest to identify third-party components by comparing an application’s source code to code that exists in external repositories. However, some SCA tools are also capable of scanning binaries (meaning compiled code) and looking for binary signatures that match those of third-party software components.

Benefits of Software Composition Analysis

Software Composition Analysis offers two chief benefits:

• Detection of third-party software components that introduce vulnerabilities or other security risks into an application. Knowing which specific parts of the application create risks makes it easier for developers to identify and mitigate supply chain security threats.
• Identification of third-party software components that may be subject to specific licensing terms, like those defined in a particular open source license. This is important because failure to adhere to those licensing terms could lead to legal and compliance risks for the organization.

Note as well that SCA offers the benefit of being able to provide visibility into potential security and licensing issues without requiring developers to document software components manually. In a perfect world, programmers would carefully record each third-party resource that they use when creating an application. But in the real world, developers often borrow third-party components without documenting them, or forget to update lists of components as their application evolves. SCA makes it possible to determine what’s inside an application even if no SBOM or other list of components exists originally.

Integrating SCA scanning into software development

While it’s possible to perform one-off SCA scans, SCA is most effective when it’s integrated into the secure software development lifecycle (SSDLC). With this integration in place, SCA scanning occurs whenever new code enters the development pipeline, and/or whenever code is compiled.

Exactly how to integrate SCA scanning into the SSDLC depends on which software development tools and Continuous Integration/Continuous Delivery (CI/CD) software you use. Some CI/CD platforms offer built-in SCA scanning features, but you can also usually deploy a standalone SCA scanner and integrate it into your development processes by triggering automated scans as code flows down the pipeline.

Software Composition Analysis challenges and limitations

Software Composition Analysis can help to identify some risks in applications, but it is subject to several important challenges and limitations:

• SCA scanning usually only detects known risks, such as vulnerabilities reported in vulnerability database.
• SCA can only identify risks linked to third-party software components. It doesn’t reveal issues like code injection vulnerabilities within source code written by a company’s own developers (although SAST scanning can be helpful for this purpose).
• SCA reporting formats can vary, making it challenging to share and analyze results in a consistent way. This is even true when SCA tools generate lists of components as SBOMs, since there are multiple SBOM formats.
• As noted above, SCA scans are most effective when they analyze raw source code, but not all applications are available in this form.
• In some cases, the components that SCA flags as vulnerable may only pose a risk under certain configurations or versions, and SCA tools aren’t always able to evaluate these factors. As a result, they may generate false positive alerts.

Future trends in SCA 

Software Composition Analysis is a well-established part of application security, but it continues to evolve as organizations embrace innovative SCA practices and strategies, such as:

• Automated SCA: It’s possible to perform SCA scans manually, but automating SCA scanning helps make the process more systematic. This is why it’s increasingly common to see SCA integrated in the SSDLC.
• AI-powered SCA: AI can enhance SCA scanning by, for example, generating remediation guidance that helps developers determine how best to mitigate vulnerable software components.
• Regulatory changes: Whereas businesses once performed SCA scans primarily as a voluntary means of identifying internal risks, regulations are increasingly requiring SBOMs. Since SCA scans are an efficient way of generating and updating SBOMs, SCA is playing a growing role in meeting regulatory requirements.

Getting started with Aqua Trivy, an open source SCA tool

If you’re looking for a flexible, free and open source SCA tool, Aqua Trivy offers an excellent solution. To perform SCA scans with Trivy, simply point the tool at the application or package you want to evaluate. For example, to scan the latest version of the MySQL Docker container image, run:

$ trivy image mysql:latest

From there, Trivy downloads the software package (if needed), then produces a list of components and associated risks:

You can also generate the list in SBOM format using the –format flag. For example:

trivy image --format spdx-json package-name

To learn more about how Trivy and the rest of the Aqua platform provide code-to-code visibility into software security risks, schedule a demo.