SoftSec SCA

Help enterprises detect security vulnerabilities, license compliance, and developmentand operation risks in the software supply chain system.

 

Product Introduction

 

SoftSec SCA (Software Composition Analysis), provides functions such as open source software asset identification (SBOM), security risk detection, license compliance analysis, vulnerability monitoring and alarm, and open source software security management through a variety of testing technologies and a self-controlled analysis engine and powerful gene bank. It can help enterprises to alleviate risks in the security, compliance and operation of open source software, thus making efforts to build a security guarantee system for software supply chain.

 

Whether you are from governmant, in automobile industry, consumer electronics industry, finance industry, manufacturing industry, energy industry, military industry, medical industry, or you are an evaluation/regulatory agency.

 

Whatever you need standards and regulations certification, supply chain outsourcing acceptance,internal R&D safety management, M&A/sea compliance risk audit.

SCA can help you deal with software supply chain security compliance challenges!

 

 

 

Application Scenarios

 

Comply with standards, regulations and certification requirements

--

 

•  UN R155/156 Automotive Information Security and Software Upgrade Requirements
•  GB 44495/44496 Technical Requirements for Vehicle Cybersecurity (National Standards)
•  ISO/SAE 21434 Road Vehicles - Cybersecurity Engineering
•  ETSI EN 303 645 Information Security Standard for Consumer Internet of Things Products
•  IoT Device Security Specification
•  Inspection requirements for open source governance in financial or customs-related industries.

 

 

Inspection baseline covers both the upstream and downstream of supply chain

--

 

•  Safety compliance inspection of domestic/foreign supply chain manufacturers
•  SBOM(SPDX, CycloneDX, SWID,CPE)
•  Notice(License, CopyRight)
•  Must not contain known high-risk vulnerabilities for more than 6 months
•  Must not contain blacklist components
•  Proof of compliant use of open source software is required

 

 

Maintain the leading competitiveness of external open source

--

 

•  Trace inspection of components before open source  
•  Open source compliance risk model-advice on disposal and case knowledge base
•  Compliance with high-risk open source license guidelines
•  Security risk detection and threat intelligence report
•  Maintain the positive leading image of enterprises and communities  

 

 

Carry Out Authentication of  Information Technology Application Innovation (ITAI) and Ecological Construction

--

•  Trace source code independently
•  Autonomous controllable authentication
•  Evaluation model of open source software ITAI
•  Software similarity evaluation

 

 

Implement Internal Security Management and Control of Enterprises

--

•  Continuous vulnerability  noise reduction
•  Analysis of the real impact of vulnerabilities with environmental factors taken into account
•  Function-level vulnerability data  detection
•  Vulnerability reachability detection
•  R&D system integration service
•  Integrated business vulnerability library  

 

 

Operate A Safe and Reliable Software Supply Chain

--

 

•  Unified asset identification Software quality evaluation
•  Comprehensive evaluation of suppliers
•  Runtime risk and situation awareness
•  Operation of enterprise software cockpit

 

 

Support HVV Security Self-inspection and Protection

--

•  Hourly monitoring of vulnerability and public opinion
•  POC/EXP/RCE analysis of vulnerability
•  Analysis of the true scope of vulnerability that can supplement NVD
•  Multi-scheme vulnerability mitigation measures

 

 

Advantages

 

[More Comprehensive] Gene database (KB) scale

 

11 million  Project Components

 

260 million  Open Source Component Versions

 

2600  Certifications

 

600000  Security Vulnerabilities

 

The AI KB operated by SoftSec Tech is one of the most comprehensive, detailed, and accurate open-source software component databases in the industry. It offers over a hundred data fields related to open-source software, security vulnerabilities, open-source licenses, and more, covering modules such as basic components, business detection, security compliance risks, and mitigation recommendations. Additionally, it provides real-time monitoring from thousands of threat data sources, including a universal vulnerability database, commercial vulnerability database, official website database, community database, and industry-specific databases. It also offers customizable and integrated entry points for enterprise-level and industry-specific vulnerability repositories, effectively enhancing the timeliness and accuracy of vulnerability detection, reducing manual auditing costs, and ensuring comprehensive software security.

 

 

[More Accurate]  Testing Accuracy

Accurate construction analysis based on programming languages such as C/C++ and Java, with automated detection of dynamic software dependencies, delivering a dependency list that accurately reflects the software’s runtime environment.

 

 

[More Rapid]  Testing Speed

The average testing speed of each component is 200ms, enabling minute-level analysis for standard projects. Ensures stable detection and comprehensive risk alerts for ultra-large projects exceeding 100GB, leaving no issues overlooked.

 

 

[More] Detection type

Build/compile dependency detection

File directory analysis

No build dependency detection

Code fragment detection

Binary detection

 

[More Compliant] Compliance ability

Open source compliance Conflict/compatibility

Deep license/copyright

Open source compliance advice

Sensitive encryption detection technology