A practical checklist for dependency vulnerabilities

This is one of those topics that looks small until it costs you something. Run through this the next time dependency vulnerabilities comes up.

The realistic threat for most small businesses is automated and opportunistic, not targeted. The version that survives contact with a real deadline is the simple one.

The checklist

• Your code is a small part of what you ship
• Automated alerts catch what manual review never will
• Fewer dependencies is a security strategy
• Someone is named as the owner
• There is a date to review it again

The reason this keeps coming up

Your code is a small part of what you ship. In practice this is a scheduling problem more than a technical one. Doing this properly once is usually cheaper than doing it approximately three times.

In practice

The cheapest security work is the boring kind done on a schedule. Three things worth confirming about dependency vulnerabilities before you move on:

• Someone can say what the current setup is without going to look
• Fewer dependencies is a security strategy — and you know whether that is true here
• There is a way to tell whether the last change to this helped

Pick the one that would hurt most if it failed, and start there.