/sca-blackduck

name: sca-blackduck
description: >
  Software Composition Analysis (SCA) using Synopsys Black Duck for identifying open source
  vulnerabilities, license compliance risks, and supply chain security threats with CVE,
  CWE, and OWASP framework mapping. Use when: (1) Scanning dependencies for known
  vulnerabilities and security risks, (2) Analyzing open source license compliance and
  legal risks, (3) Identifying outdated or unmaintained dependencies, (4) Integrating
  SCA into CI/CD pipelines for continuous dependency monitoring, (5) Providing remediation
  guidance for vulnerable dependencies with CVE and CWE mappings, (6) Assessing supply
  chain security risks and third-party component threats.
version: 0.1.0
maintainer: SirAppSec
category: appsec
tags: [sca, blackduck, dependency-scanning, vulnerability-management, license-compliance, supply-chain, cve, owasp]
frameworks: [OWASP, CWE, NIST, SOC2, PCI-DSS]
dependencies:
  tools: [docker, git, detect]
  access: [blackduck-url, api-token]
references:
  - https://sig-product-docs.synopsys.com/bundle/bd-hub/page/Welcome.html
  - https://owasp.org/www-project-dependency-check/
  - https://nvd.nist.gov/
  - https://www.cisa.gov/sbom

Software Composition Analysis with Black Duck

Overview

Perform comprehensive Software Composition Analysis (SCA) using Synopsys Black Duck to identify security vulnerabilities, license compliance risks, and supply chain threats in open source dependencies. This skill provides automated dependency scanning, vulnerability detection with CVE mapping, license risk analysis, and remediation guidance aligned with OWASP and NIST standards.

Quick Start

Scan a project for dependency vulnerabilities:

# Using Black Duck Detect (recommended)
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
  --blackduck.url=$BLACKDUCK_URL \
  --blackduck.api.token=$BLACKDUCK_TOKEN \
  --detect.project.name="MyProject" \
  --detect.project.version.name="1.0.0"

Scan with policy violation enforcement:

# Fail build on policy violations
bash <(curl -s -L https://detect.synopsys.com/detect.sh) \
  --blackduck.url=$BLACKDUCK_URL \
  --blackduck.api.token=$BLACKDUCK_TOKEN \
  --detect.policy.check.fail.on.severities=BLOCKER,CRITICAL

Core Workflows

Workflow 1: Initial Dependency Security Assessment

Progress: [ ] 1. Identify package managers and dependency manifests in codebase [ ] 2. Run `scripts/blackduck_scan.py` with project detection [ ] 3. Analyze vulnerability findings categorized by severity (CRITICAL, HIGH, MEDIUM, LOW) [ ] 4. Map CVE findings to CWE and OWASP Top 10 categories [ ] 5. Review license compliance risks and policy violations [ ] 6. Generate prioritized remediation report with upgrade recommendations

Work through each step systematically. Check off completed items.

Workflow 2: Vulnerability Remediation

1. Review scan results and identify critical/high severity vulnerabilities 2. For each vulnerability:

• Check if fixed version is available
• Review breaking changes in upgrade path
• Consult `references/remediation_strategies.md` for vulnerability-specific guidance

3. Apply dependency updates using package manager 4. Re-scan to validate fixes 5. Document any vulnerabilities accepted as risk with justification

Workflow 3: License Compliance Analysis

1. Run Black Duck scan with license risk detection enabled 2. Review components flagged with license compliance issues 3. Categorize by risk level:

• **High Risk**: GPL, AGPL (copyleft licenses)
• **Medium Risk**: LGPL, MPL (weak copyleft)
• **Low Risk**: Apache, MIT, BSD (permissive)

4. Consult legal team for high-risk license violations 5. Document license decisions and create policy exceptions if approved

Workflow 4: CI/CD Integration

1. Add Black Duck Detect to CI/CD pipeline using `assets/ci_integration/` 2. Configure environment variables for Black Duck URL and API token 3. Set policy thresholds (fail on CRITICAL/HIGH vulnerabilities) 4. Enable SBOM generation for supply chain transparency 5. Configure alerts for new vulnerabilities in production dependencies

Workflow 5: Supply Chain Risk Assessment

1. Identify direct and transitive dependencies 2. Analyze component quality metrics:

• Maintenance activity (last update, commit frequency)
• Community health (contributors, issue resolution)
• Security track record (historical CVEs)

3. Flag high-risk components (unmaintained, few maintainers, security issues) 4. Review alternative components with better security posture 5. Document supply chain risks and mitigation strategies

Security Considerations

• **Sensitive Data Handling**: Black Duck scans require API tokens with read/write access.

Store credentials securely in secrets management (Vault, AWS Secrets Manager). Never commit tokens to version control.

• **Access Control**: Limit Black Duck access to authorized security and development teams.

Use role-based access control (RBAC) for scan result visibility and policy management.

• **Audit Logging**: Log all scan executions with timestamps, user, project version, and

findings count for compliance auditing. Enable Black Duck's built-in audit trail.

• **Compliance**: SCA scanning supports SOC2, PCI-DSS, GDPR, and HIPAA compliance by

tracking third-party component risks. Generate SBOM for regulatory requirements.

• **Safe Defaults**: Configure policies to fail builds on CRITICAL and HIGH severity

vulnerabilities. Use allowlists sparingly with documented business justification.

Supported Package Managers

Black Duck Detect automatically identifies and scans:

• **JavaScript/Node**: npm, yarn, pnpm
• **Python**: pip, pipenv, poetry
• **Java**: Maven, Gradle
• **Ruby**: Bundler, gem
• **.NET**: NuGet
• **Go**: go modules
• **PHP**: Composer
• **Rust**: Cargo
• **C/C++**: Conan, vcpkg
• **Docker**: Container image layers

Bundled Resources

Scripts

• `scripts/blackduck_scan.py` - Full-featu