◇ OpenCyber Academy
Technical · Chapter 15 · English

Chapter 15 — Application and software supply chain security: integration and dependencies

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 15 — Application and software supply chain security: integration and dependencies

Lesson map

Lesson 15 published. Map, example, EX057.

flowchart TD
  N0["Learning outcomes"]
  N1["15.1 Dependency chains"]
  N2["15.2 Third-party scripts"]
  N3["15.3 Recording dependencies"]
  N4["15.4 Reducing dependencies"]
  N5["15.5 SBOMs"]
  N6["15.6 Updates and compatibility"]
  N7["Reviewing outside scripts"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7
  N7 --> EX["Worked example"]
  EX --> Q["Exercise EX057"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["15.1 Dependency chains"]
  N2["15.2 Third-party scripts"]
  N3["15.3 Recording dependencies"]
  N4["15.4 Reducing dependencies"]
  N5["15.5 SBOMs"]
  N6["15.6 Updates and compatibility"]
  N7["Reviewing outside scripts"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> N6 --> N7 --> Q["EX057"]

[Learning outcomes]
    |
    v
[15.1 Dependency chains]
    |
    v
[15.2 Third-party scripts]
    |
    v
[15.3 Recording dependencies]
    |
    v
[15.4 Reducing dependencies]
    |
    v
[15.5 SBOMs]
    |
    v
[15.6 Updates and compatibility]
    |
    v
[Reviewing outside scripts]
    |
    v
[Worked example] --> [Exercise EX057]

Learning outcomes

You will (1) understand how plugins depend on other components; (2) check third-party scripts and services; (3) manage dependency chains; (4) reduce unneeded dependencies.

15.1 Dependency chains

Plugins often bundle libraries, and the shop application depends on the language runtime and its packages. Decan et al. (2018) showed how dependency networks grow across ecosystems, and Zimmermann et al. (2019) showed how a few maintainers can reach many projects. A flaw deep in the chain can affect sites that never chose that library. For Pinecrest, this means an advisory may name a library that no customer ever chose, bundled inside a plugin such as the resize plugin. The bundled libraries are recorded in the inventory where vendors report them.

15.2 Third-party scripts

Many sites load scripts from outside services: analytics, chat widgets, payment forms. Each is a dependency outside Pinecrest's control, and CSP lists them explicitly. These scripts run in visitors' browsers even though Pinecrest never installs them on its servers. Listing them in each site's CSP makes each one a visible decision rather than a silent addition. The review of outside scripts later finds several sites still loading scripts from services they had stopped using. Payment forms in particular are reviewed carefully, since they handle card details.

15.3 Recording dependencies

The inventory adds bundled libraries reported by plugins and outside script domains from each site's CSP. Adding bundled libraries means an advisory naming a library can be matched to sites, not only advisories naming plugins. Reading outside script domains from each CSP turns the policy into an inventory source as well as a control. The customer's owner for each remaining script is recorded alongside it, so questions go to the right person. The dependency data is refreshed by the same nightly job as the plugin list.

15.4 Reducing dependencies

Unused plugins and scripts are removed with customer agreement; every removal shrinks the chain. The worked example shows the scale: 61 sites had plugins installed but disabled, and customers agreed to remove them from 54 sites, cutting 140 installations. Each removed installation is one less entry to compare with advisories, one less folder to check for permissions and one less path for changed code. Removal follows the normal procedure, with a backup taken first. The remaining seven sites kept their disabled plugins at the customers' request, and that decision is recorded.

15.5 SBOMs

Some vendors publish a software bill of materials listing components; NTIA (2021) describes minimum elements. Where available, Pinecrest uses SBOMs to see bundled libraries. An SBOM lists components by name and version, so Pinecrest can match bundled libraries against advisories without unpacking each plugin. Few plugin vendors publish one yet, which is why extending the inventory through SBOMs appears in Tomás's next steps rather than in his completed work. SBOM data is checked against installed files on a sample of sites first.

15.6 Updates and compatibility

Updating one component may require others; updates are tested together on a test copy. Updating a plugin may require a newer shop application or library, and updating the application may break an older plugin. Testing the set together on a test copy with synthetic data shows such conflicts before they reach a customer's live shop. The rollback plan covers the whole set, not each part. Results from the combined test are recorded in the ticket before any live update is scheduled.

Reviewing outside scripts

For each outside script domain, Tomás asks the customer what it is for. Several sites still load scripts from services they stopped using years ago. Removing them shortens the CSP and removes code that runs in visitors' browsers without any benefit. For scripts that remain, the inventory records the service and its owner at the customer.

Yearly dependency review

Once a year, support reviews each popular plugin's maintenance activity and bundled libraries.

Worked example

Reviewing dependencies, Tomás finds 61 sites with plugins installed but disabled. Customers agree to remove them from 54 sites, cutting 140 installations that would otherwise need tracking and updating.

Synthetic case. Counts are synthetic.

Errors and limits

Disabled plugins still have files on the server; remove, do not just disable.

Exercises

Synthesis

Know and shrink the dependency chain.

Continue studying — chapter 15 of 18

← Chapter 14 (draft) · Course chapter index · Chapter 16 (draft) →