System and method for monitoring security vulnerabilities in software applications having third party software components

Abstract

To provide a method for monitoring security vulnerabilities in a software application having third party software components.SOLUTION: The method includes receiving a software bill of materials (SBOM) including a plurality of third party software components, automatically analyzing each of the plurality of third party software components of the SBOM for known vulnerabilities and generating and storing a first list of known vulnerabilities, automatically analyzing for newly discovered vulnerabilities after a first period of time, storing a condensed second list of known vulnerabilities, comparing the condensed second list of known vulnerabilities to the first list of known vulnerabilities, and in response to the second list differing from the first list, sending a notice over a network identifying a set of differences in vulnerabilities between the second list and the first list.SELECTED DRAWING: Figure 3

Description

[Technical Field]

[0001] The present invention relates to the field of security vulnerability monitoring, and more particularly to a system and method for monitoring security vulnerabilities in software applications having third-party software components. [Background technology]

[0002] Modern software is written using third-party and open-source components. These components are assembled in diverse and complex ways and integrate with the original code to provide desired functionality. Third-party software components (e.g., commercially licensed components, proprietary components, and open-source components) provide numerous building blocks that enable programmers to deliver value, improve quality, and reduce risk and time to market when building software applications. These third-party software components are often open source and available through online repositories (e.g., NuGet for C#, npm for Node.js, and Maven Central for Java / Maven projects). Third-party software components offer many benefits. However, using third-party software components can require developers to assume responsibility for managing and addressing any issues that arise with these components.

[0003] Software Composition Analysis (SCA) is a tool that helps manage third-party software components. SCA tools analyze custom software applications to discover embedded third-party software and whether it is up-to-date, contains security flaws, or has permission requirements. Using SCA, development teams can quickly track and analyze third-party software components brought into a project. SCA tools can discover all related components, their supporting libraries, and their direct and indirect dependencies. SCA tools can also detect software licenses, deprecated dependencies, and potential vulnerabilities and exploits. After the application is audited, a software bill of materials (SBOM) is generated, providing a complete inventory of the project's software assets.

[0004] Due to the increasing serious threat of cyber attacks, it is essential for companies with software applications that include third-party software components to become aware of newly discovered vulnerabilities in the third-party software components used by those applications as soon as possible, so that they can quickly analyze the vulnerabilities and determine whether the third-party software components are being used in a way that introduces vulnerabilities into the application itself. Summary of the Invention [Problem to be solved by the invention]

[0005] Therefore, there is a need for improved methods and apparatus for automatically and continuously monitoring for security vulnerabilities in software applications having third-party software components and for reporting newly discovered vulnerabilities in third-party software components used by a particular software application. [Means for solving the problem]

[0006] Accordingly, one aspect of the present invention provides a computer-implemented method for continuously monitoring and reporting newly discovered vulnerabilities in third-party software components used in building a software application, the method including: receiving a software bill of materials (SBOM) for a software application that includes a plurality of third-party software components, automatically analyzing each of the plurality of third-party software components in the SBOM for known vulnerabilities to generate a first list of known vulnerabilities, storing the first list of known vulnerabilities for the software application, automatically analyzing each of the plurality of third-party software components identified in the SBOM for newly discovered vulnerabilities after a first period of time, storing a second compiled list of known vulnerabilities for the software application, comparing the second compiled list of known vulnerabilities with the first list of known vulnerabilities, and, in response to the second compiled list differing from the first list, transmitting a first notification over a network identifying a first set of differences in vulnerabilities between the second compiled list and the first list.

[0007] Another aspect of the present invention provides a computer system for continuously monitoring and reporting newly discovered vulnerabilities in third-party software components used in building a software application, the system comprising one or more computer processors, one or more computer-readable storage media, and program instructions stored on the computer-readable storage media for execution by at least one of the one or more processors.

[0008] The program instructions include program instructions for receiving a software bill of materials (SBOM) for a software application that includes a plurality of third-party software components; automatically analyzing each of the plurality of third-party software components in the SBOM for known vulnerabilities to generate a first list of known vulnerabilities; storing the first list of known vulnerabilities for the software application; after a first period of time, automatically analyzing each of the plurality of third-party software components identified in the SBOM for newly discovered vulnerabilities; storing a second compiled list of known vulnerabilities for the software application; comparing the second compiled list of known vulnerabilities with the first list of known vulnerabilities; and, in response to the second compiled list differing from the first list, sending a first notification over a network identifying a first set of differences in vulnerabilities between the second compiled list and the first list.

[0009]

[0009] Certain aspects of the present invention provide a computer program product for continuously monitoring and reporting newly discovered vulnerabilities in third-party software components used in building a software application. The computer program product comprises a computer-readable storage medium having program code embodied thereon that is executable by a processor to: receive a software bill of materials (SBOM) for a software application that includes a plurality of third-party software components; automatically analyze each of the plurality of third-party software components in the SBOM for known vulnerabilities to generate a first list of known vulnerabilities; store the first list of known vulnerabilities for the software application; after a first period of time, automatically analyze each of the plurality of third-party software components identified in the SBOM for newly discovered vulnerabilities; store a second compiled list of known vulnerabilities for the software application; compare the second compiled list of known vulnerabilities with the first list of known vulnerabilities; and, in response to the second compiled list differing from the first list, send a first notification over a network identifying a first set of differences in vulnerabilities between the second compiled list and the first list.

[0010] Other aspects, advantages and novel features of the invention will be described in part below and in part will become apparent to those who practice the invention when considered in conjunction with the accompanying drawings. [Brief explanation of the drawings]

[0011] The invention will now be described, by way of example only, with reference to the accompanying drawings, in which: [Figure 1] FIG. 1 is a block diagram illustrating a software bill of materials generated by software composition analysis, according to some embodiments. [Figure 2]FIG. 2 is a block diagram illustrating a security vulnerability monitor that analyzes vulnerabilities based on a software bill of materials, according to some embodiments. [Figure 3] FIG. 3 is a flowchart illustrating the operational steps of a security vulnerability monitor, according to one particular embodiment. [Figure 4] 4 shows a block diagram of components of a computing device executing an information processing program, according to some embodiments. Corresponding reference characters indicate corresponding parts throughout the drawings. The examples set forth herein represent presently preferred embodiments of the invention, and such examples should not be construed as limiting the scope of the invention in any way. DETAILED DESCRIPTION OF THE INVENTION

[0012] As will be appreciated by one skilled in the art, aspects of the present invention may be embodied as a system, method, or computer program product. Accordingly, aspects of the present invention may take the form of an entirely hardware embodiment, an entirely software embodiment (including firmware, resident software, microcode, etc.), or an embodiment combining software and hardware aspects, which may be generally referred to herein as a "circuit," "module," or "system." Furthermore, aspects of the present invention may take the form of a computer program product embodied in one or more computer-readable medium(s) having computer-readable program code / instructions embodied thereon.

[0013] Any combination of computer-readable media may be utilized. The computer-readable medium may be a computer-readable signal medium or a computer-readable storage medium. The computer-readable storage medium may be, for example, but not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any suitable combination thereof. More specific examples (non-exhaustive list) of computer-readable storage media would include an electrical connection having one or more wires, a portable computer diskette, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disc read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination thereof. In the context of this specification, a computer-readable storage medium may be any tangible medium that can contain or store a program for use by or in connection with an instruction execution system, apparatus, or device.

[0014] The program code embodied on the computer readable medium may be transmitted using any suitable medium, such as, but not limited to, wireless, wired, fiber optic cable, or RF, or any suitable combination thereof.

[0015] Computer program code for carrying out operations of aspects of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, Smalltalk, or C++, and conventional procedural programming languages ​​such as the "C" programming language or similar programming languages. The program code may run entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or may be connected to an external computer (e.g., over the Internet using an Internet Service Provider).

[0016] Aspects of the present invention are described below with reference to flowchart illustrations and / or block diagrams of methods, apparatus (systems), and computer program products according to embodiments of the invention. It will be understood that each block of the flowchart illustrations and / or block diagrams, and combinations of blocks in the flowchart illustrations and / or block diagrams, can be implemented by computer program instructions. These computer program instructions may be provided to a processor of a general-purpose computer, a special-purpose computer, or other programmable data processing apparatus to produce a machine. These instructions, when executed by the processor of the computer or other programmable data processing apparatus, generate means for implementing the functions / acts specified in the flowcharts and / or blocks of the block diagrams.

[0017] These computer program instructions may be stored on a computer-readable medium that can direct a computer, other programmable data processing apparatus, or other device to function in a particular way, such that the instructions stored on the computer-readable medium produce an article of manufacture including instructions that implement the functions / acts specified in the flowcharts and / or block diagrams.

[0018] The computer program instructions, when loaded into a computer, other programmable data processing apparatus, or other device, cause the computer, other programmable apparatus, or other device to execute a series of operational steps to thereby generate a computer-implemented process such that the instructions, when executed on the computer or other programmable apparatus, provide a process for implementing the functions / acts specified in the flowcharts and / or block diagram blocks.

[0019] Developing software using different software components is not uncommon in software engineering. Using software components allows large pieces of complex code to be broken down into smaller chunks of code, facilitating component reuse and increasing coding flexibility when addressing new needs. Third-party software components (e.g., commercially licensed, proprietary, and open-source components) often provide numerous building blocks that enable programmers to build software applications, adding value, improving quality, and reducing risk and time to market. These third-party software components are often open source and available through online repositories. However, using third-party software components introduces many risks to the software application under development. For example, using third-party software components introduces risks of changes with new versions, vulnerabilities in the components, intellectual property (IP) legal requirements, compatibility between the existing code base and third-party software components, and inadequate documentation and outdated software components.

[0020] In an attempt to manage the risks associated with third-party software components, developers have traditionally tracked all third-party software components used by the developer through manual entry into spreadsheets and documents. However, the widespread use of third-party software components necessitates automating the analysis and management of risks associated with third-party software components.

[0021] Software composition analysis (SCA) helps manage risks associated with third-party software components. SCA attempts to discover all third-party software components used within a software application to help reduce risks associated with security vulnerabilities, IP permission requirements, and outdated components in use. SCA begins with an analysis engine that examines the software source code and related artifacts used to compile the software application. The analysis engine identifies third-party software components and their versions and stores this information in a database, creating a catalog of third-party software components used in the examined application. This catalog can be compared to databases that reference known security vulnerabilities for each third-party software component, permission requirements for using the third-party software component, and past versions of the third-party software component. To detect security vulnerabilities, this comparison may be performed against known security vulnerabilities (CVEs) tracked in, for example, the National Vulnerability Database (NVD) maintained by the National Institute of Standards and Technology, the Sonatype open source security (OSS) Index, the GitHub Security Advisories (GHSA) database, the Snyk Vulnerability Database, or the Common Vulnerabilities and Exposures (CVE) database.

[0022] The results of SCA are made available to end users using different digital formats. The content and format depend on the SCA tool used, but may include guidance for assessing and analyzing risks, as well as advice, especially regarding legal requirements for third-party software components, such as strong or weak copyright licensing. The output may also include a software bill of materials (SBOM), which lists all open source components used in a software application and their associated attributes.

[0023] Referring now to the drawings, and initially to Figure 1, an exemplary block diagram illustrating a software bill of materials generated by software composition analysis is provided, according to some embodiments. The software bill of materials (SBOM) 100 may be created by one or more SCA software tools. The SBOM 100 may include a catalog of third-party software components 102 used by an application.

[0024] While performing SCA to generate an SBOM and identify known vulnerabilities can help manage risks associated with third-party software components, it is not uncommon for new vulnerabilities to be discovered after the SBOM is created and the initial vulnerability analysis is performed. Accordingly, embodiments of the present invention use a security vulnerability monitor to automatically and continuously monitor for security vulnerabilities in software applications that have third-party software components and to report newly discovered vulnerabilities in third-party software components used by a particular software application.

[0025] An exemplary embodiment of the present invention will now be described with joint reference to the block diagram shown in Figure 2 and the flowchart provided in Figure 3. Figure 2 is a block diagram illustrating a security vulnerability monitor 210 that analyzes vulnerabilities based on a software bill of materials, and Figure 3 is a flowchart illustrating the operational steps of the security vulnerability monitor. Additionally, exemplary components of one or more computing devices that execute information processing programs, according to an exemplary embodiment, are described in Figure 4.

[0026] 2-4, operational steps 300 of the security vulnerability monitor 210 may begin at step 302. The security vulnerability monitor 210 receives 212 a software bill of materials (SBOM) 100 that includes an identification of multiple third-party software components 102 from an SCA tool.

[0027] In step 304, the vulnerability analyzer 220 of the security vulnerability monitor 210 automatically analyzes each of the plurality of third-party software components in the received SBOM for known vulnerabilities, thereby generating (222) a first list of known vulnerabilities 2041. The types of vulnerabilities identified in the list of known vulnerabilities 2041 include, but are not limited to, security configuration vulnerabilities, network vulnerabilities, operating system vulnerabilities, process / procedural vulnerabilities, human vulnerabilities, cross-site scripting vulnerabilities, insecure dependencies, undisclosed URLs, injection vulnerabilities, exploit date vulnerabilities, broken authentication vulnerabilities, and buffer overflow vulnerabilities. However, a vulnerability in a third-party software component 102 may or may not result in a vulnerability in an application that utilizes the third-party software component 102, depending on how the software component is configured or invoked.

[0028] In step 306, the security vulnerability monitor 210 stores (224) a first list 2041 of known vulnerabilities corresponding to at least some of the plurality of third-party software components 102 in a database 250 stored in memory 436, for example. In step 308, after a first period of time, each of the plurality of third-party software components 102 is automatically analyzed for newly discovered vulnerabilities by a vulnerability analyzer 220 of the security vulnerability monitor 210 to generate a second list 2042 of known vulnerabilities. The first period of time may be a predetermined period of time or a user-adjustable period of time. The second list 2042 of known vulnerabilities may include an updated list of the most recent known vulnerabilities corresponding to at least some of the plurality of third-party software components 102.

[0029] As mentioned above, the types of vulnerabilities identified in the list of known vulnerabilities 204 include, but are not limited to, security configuration vulnerabilities, network vulnerabilities, operating system vulnerabilities, process / procedural vulnerabilities, human vulnerabilities, cross-site scripting vulnerabilities, insecure dependencies, undisclosed URLs, injection vulnerabilities, exploit date vulnerabilities, broken authentication vulnerabilities, and buffer overflow vulnerabilities. However, a vulnerability in a third-party software component may or may not result in a vulnerability in an application that utilizes the third-party software component, depending on how the software component is configured or invoked.

[0030] In certain embodiments, automatically analyzing each of the plurality of third-party software components 102 identified in the SBOM for known vulnerabilities may include querying at least one external vulnerability database 470 for known vulnerabilities for each of the plurality of third-party software components 102 identified in any of the SBOMs. In some embodiments, the plurality of external vulnerability databases 470 may be queried for known vulnerabilities for each of the plurality of third-party software components 102 identified in the SBOM 100 to provide the compiled second list 204 (i.e., second list 2042) of current known vulnerabilities. For example, the plurality of external vulnerability databases 470 may include at least one of the National Vulnerability Database (NVD) maintained by the National Institute of Standards and Technology, the Sonatype open source security (OSS) Index, the GitHub Security Advisories (GHSA) database, the Snyk Vulnerability Database, or the Common Vulnerabilities and Exposures (CVE) database.

[0031] In step 310, the security vulnerability monitor 210 may store (224) a second list 2042 corresponding to at least some of the plurality of third-party software components 102, for example, in a database 250 stored in memory 436. In step 312, the second list 2042 is used (226) by a vulnerability comparator 230 to compare it with the first list 2041 of known vulnerabilities retrieved (228) from the database 250.

[0032] If the second list 2042 does not match the first list 2041, then one or more new vulnerabilities 232 have been found. In response to the second list 2042 differing from the first list 2041, the new vulnerability notifier 240 of the security vulnerability monitor 210 may, in step 314, transmit a notification 242 over the network 420 identifying a first set of differences in vulnerabilities between the second list 2042 and the first list 2041. That is, the one or more new vulnerabilities 232 may be identified and transmitted in the notification 242 to one or more remote computing devices 244, such as computing devices 244a, 244b, and 244c, via email, text message, telephone call, or other suitable means for transmitting a notification 242. In some embodiments, the one or more new vulnerabilities 232 may be identified and transmitted to the one or more remote computing devices 244 using different transmission means based on the configuration settings associated with each of the computing devices 244.

[0033] After the notification 242 identifying the one or more new vulnerabilities 232 is sent by the new vulnerability notifier 240 to the one or more computing devices 244 over the network 420, the security vulnerability monitor 210 may return to step 308. After the second period of time, each of the plurality of third-party software components 102 may be automatically analyzed for newly discovered vulnerabilities by the vulnerability analyzer 220 to generate a third list of known vulnerabilities 2043. The third list 2043 may include the most recent known vulnerabilities corresponding to at least some of the plurality of third-party software components 102.

[0034] Similarly, if, in step 312, it is determined that the second list 2042 is identical to the first list 2041, the new vulnerability notifier 240 does not send a notification 242, but the security vulnerability monitor 210 may return to step 308. After a second period of time, each of the plurality of third-party software components 102 is automatically analyzed for newly discovered vulnerabilities by the vulnerability analyzer 220, and an updated list 204 of known vulnerabilities is generated. Nmay be generated.

[0035] It will be appreciated that in certain embodiments, the first and second periods may be equal, while in other embodiments, the first and second periods may be different.

[0036] Additionally, in some embodiments, an updated list of the latest known vulnerabilities 204 N is compared to the first list 2041 to obtain an updated list 204 of the latest known vulnerabilities that have already been notified to one or more remote computing devices 244. N Any discrepancies between the first list 2041 and the first list 2042 may be removed from the list of newly identified vulnerabilities. As a result, vulnerabilities that have already been reported may be removed from the list of newly identified vulnerabilities. N and the first list 2041 may be omitted from subsequent notifications identifying a set of differences in vulnerabilities between the first list 2041 and the second list 2041.

[0037] For example, after the second period of time, each of the plurality of third-party software components identified in the SBOM may be automatically analyzed for newly discovered vulnerabilities. A third list 2043 of known vulnerabilities corresponding to at least some of the plurality of third-party software components 102 may be compiled and stored, for example, in memory 436. The third list 2043 of known vulnerabilities may be compared to the first list 2041 of known vulnerabilities. In response to the third list 2043 differing from the first list 2041, a notification identifying a second set of differences in vulnerabilities may be transmitted over network 420, where the second set of differences in vulnerabilities is the differences between the third list 2043 and the first list 2041 of known vulnerabilities minus the first set of differences in vulnerabilities between the second list 2042 and the first list 2041.

[0038] However, in other embodiments, the updated list of the latest known vulnerabilities 204 N is the most recently saved list of vulnerabilities 204 N-1and may be compared against the identified vulnerabilities and included as one or more new vulnerabilities 232 that are identified and sent in a notification 242 to one or more remote computing devices 244 via email, text message, telephone call, or other suitable means of communication.

[0039] For example, after the second period of time, each of the plurality of third-party software components 102 identified in the SBOM may be automatically analyzed for newly discovered vulnerabilities. A third list 2043 of known vulnerabilities corresponding to at least some of the plurality of third-party software components 102 may be compiled and stored in a database 250 stored in memory 436, for example. The third list 2043 of known vulnerabilities may be compared to the second list 2042 of known vulnerabilities. In response to the third list 2043 differing from the second list 2042, a notification may be transmitted over the network 420 identifying a second set of differences in vulnerabilities, where the second set of differences in vulnerabilities are the differences between the third list 2043 of known vulnerabilities and the second list 2042 of known vulnerabilities.

[0040] It will be appreciated that the security vulnerability monitor 210 may be a software tool that automatically runs continuously, near-continuously, or periodically (e.g., hourly, several times a day, daily, every other day, weekly, or any other useful period) and scans online databases for newly discovered vulnerabilities.

[0041] Referring to FIG. 4, an exemplary computing environment 400 is shown that can be utilized through programming to implement any of the processes described above. The computing environment 400 may include a computer 412 that includes a video interface 426, a network interface 428, one or more serial ports 432, a keyboard / mouse interface 434, and a system bus 424 that couples system memory 436 to a central processing unit (CPU) 438. The computer 412 may also include a graphics processing unit (GPU) or one or more other special-purpose or general-purpose processing units. A monitor or display 440 is connected to the bus 424 by the video interface 426 and provides a user with a graphical user interface for viewing, editing, and otherwise manipulating items displayed on the computer 412. The graphical user interface allows a user to enter commands and information into the computer 412 using a keyboard 441 and a user interface selection device 443, such as a mouse or other pointing device. The keyboard 441 and user interface selection device 443 are connected to the bus 424 through the keyboard / mouse interface 434. Display 440 and user interface selection device 443 together form a graphical user interface that enables a user to implement at least a portion of the present invention. Other peripheral devices may be connected to computer 412 through serial port 432 or universal serial bus (USB) drive 445 to transfer information to and from computer 412.

[0042] System memory 436 is also connected to bus 424 and may include read-only memory (ROM), random-access memory (RAM), an operating system 444, a basic input / output system (BIOS) 446, application programs 448, and program data 450. Computer 412 may further include a hard disk drive 452 for reading from and writing to a hard disk, a magnetic disk drive 454 for reading from and writing to a removable magnetic disk (e.g., a floppy disk), and an optical disk drive 456 for reading from and writing to a removable optical disk (e.g., a CD-ROM or other optical media). Computer 412 may also include a USB drive 445 and other types of drives for reading from and writing to flash memory devices (Compact Flash, Memory Stick / PRO and DUO, SD cards, multimedia cards, and SmartMedia cards), and a scanner 458 for scanning items such as digital images for downloading to computer 412. Hard disk drive interface 452a, magnetic disk drive interface 454a, optical disk drive interface 456a, USB drive interface 445a, and scanner interface 458a operate to connect bus 424 to hard disk drive 452, magnetic disk drive 454, optical disk drive 456, USB drive 445, and scanner 458, respectively. Each of these drive components and their associated computer-readable media may provide computer 412 with non-volatile storage of computer-readable instructions, program modules, data structures, application programs, operating system, and other data for computer 412. It will also be appreciated that computer 412 may utilize other types of computer-readable media in addition to those described herein, such as digital video disks, random access memory, read-only memory, other types of flash memory cards, and magnetic cassettes.

[0043] Network interface 428 provides computer 412 with a communication path 460 between bus 424 and network 420. This communication path 460 allows notifications, information, and other data to be transmitted from any of the previously identified devices over network 420 and, in some cases, stored in memory. This type of logical network connection is often used in conjunction with local area networks. Images may be transmitted from bus 424 over communication path 462 to network 420 using serial port 432 and modem 464. A modem connection between computer 412 and other computing devices, databases, or the like, may be used in conjunction with a wide area network or the Internet. It will be understood that the network connections shown herein are merely exemplary, and that other types of network connections between computer 412 and other computing devices, including both wired and wireless connections, are within the scope of the present invention.

[0044] As described above, embodiments of the present invention provide an improved method and security vulnerability monitor for automatically and continuously monitoring security vulnerabilities in software applications having third-party software components and reporting newly discovered vulnerabilities in third-party software components used by a particular software application.

[0045] Computer program code for carrying out operations of the present invention may be written in any combination of one or more programming languages, including object-oriented programming languages ​​such as Java, Smalltalk, or C++, and conventional procedural programming languages ​​such as the "C" programming language or similar programming languages. The program code may run entirely on the user's computer, partially on the user's computer, as a stand-alone software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the latter case, the remote computer may be connected to the user's computer through any type of network, including a local area network ("LAN") or a wide area network ("WAN"), or may be connected to the external computer (e.g., over the Internet using an Internet Service Provider).

[0046] Based on the foregoing, a method, computer system, and program product according to the present invention have been disclosed. However, numerous modifications and substitutions can be made without departing from the scope of the present invention. Accordingly, the present invention has been disclosed by way of example only, and not by way of limitation.

Claims

1. 1. A computer-implemented method for continuously monitoring and reporting newly discovered vulnerabilities in third-party software components used in a software application, comprising: receiving a software bill of materials (SBOM) for the software application that includes a plurality of third-party software components; automatically analyzing each of the plurality of third-party software components of the software bill of materials for known vulnerabilities to generate a first list of known vulnerabilities; storing the first list of known vulnerabilities for the software application; automatically analyzing each of the plurality of third-party software components identified in the software bill of materials for newly discovered vulnerabilities after a first period of time; storing a compiled second list of known vulnerabilities for said software application; comparing the compiled second list of known vulnerabilities with the first list of known vulnerabilities; transmitting, in response to the compiled second list differing from the first list of known vulnerabilities, a first notification over a network identifying a first set of differences in vulnerabilities between the compiled second list of known vulnerabilities and the first list; A computer-implemented method comprising:

2. automatically analyzing each of the plurality of third-party software components identified in the software bill of materials for newly discovered vulnerabilities after a second period of time; storing a compiled third list of known vulnerabilities for said software application; comparing the compiled third list of known vulnerabilities with the first list of known vulnerabilities; transmitting a second notification over the network identifying a second set of differences in vulnerabilities in response to the compiled third list differing from the first list of known vulnerabilities; Further comprising: the second set of differences in vulnerabilities is the differences between the compiled third list of known vulnerabilities and the first list of known vulnerabilities minus the first set of differences in vulnerabilities between the compiled second list of known vulnerabilities and the first list of known vulnerabilities; The first period and the second period are equal.

10. The computer-implemented method of claim 1.

3. automatically analyzing each of the plurality of third-party software components identified in the software bill of materials for newly discovered vulnerabilities after a second period of time; storing a compiled third list of known vulnerabilities for said software application; comparing the compiled third list of known vulnerabilities with the compiled second list of known vulnerabilities; transmitting a second notification over the network identifying a second set of differences in vulnerabilities in response to the compiled third list being different from the compiled second list; Further comprising: the second set of differences in vulnerabilities are differences between the third compiled list of known vulnerabilities and the second compiled list of known vulnerabilities; The first period and the second period are equal.

10. The computer-implemented method of claim 1.

4. automatically analyzing each of the plurality of third-party software components identified in the software bill of materials for known vulnerabilities; querying at least one external vulnerability database for known vulnerabilities for each of the third-party software components identified in the software bill of materials; 10. The computer-implemented method of claim 1.

5. Querying the at least one external vulnerability database for known vulnerabilities for each of the third-party software components identified in the software bill of materials includes: querying a plurality of external vulnerability databases for known vulnerabilities for each of the third-party software components identified in the software bill of materials; 5. The computer-implemented method of claim 4.

6. the plurality of external vulnerability databases include at least one of the National Vulnerability Database (NVD) maintained by the National Institute of Standards and Technology, the Sonatype open source security (OSS) Index, the GitHub Security Advisories (GHSA) database, the Snyk Vulnerability Database, or the Common Vulnerabilities and Exposures (CVE) database; 6. The computer-implemented method of claim 5.

7. 1. A computer system for continuously monitoring and reporting newly discovered vulnerabilities in third-party software components used in a software application, comprising: one or more computer processors; one or more computer-readable storage media; program instructions stored on the computer-readable storage medium for execution by at least one of the one or more computer processors; Equipped with The program instructions include: receiving a software bill of materials (SBOM) for the software application that includes a plurality of third-party software components; automatically analyzing each of the plurality of third-party software components of the software bill of materials for known vulnerabilities to generate a first list of known vulnerabilities; storing the first list of known vulnerabilities for the software application; automatically analyzing each of the plurality of third-party software components identified in the software bill of materials for newly discovered vulnerabilities after a first period of time; storing a compiled second list of known vulnerabilities for said software application; comparing the compiled second list of known vulnerabilities with the first list of known vulnerabilities; transmitting, in response to the compiled second list differing from the first list of known vulnerabilities, a first notification over a network identifying a first set of differences in vulnerabilities between the compiled second list of known vulnerabilities and the first list; a system including program instructions for:

8. The program instructions include: automatically analyzing each of the plurality of third-party software components identified in the software bill of materials for newly discovered vulnerabilities after a second period of time; storing a compiled third list of known vulnerabilities for said software application; comparing the compiled third list of known vulnerabilities with the first list of known vulnerabilities; transmitting a second notification over the network identifying a second set of differences in vulnerabilities in response to the compiled third list differing from the first list of known vulnerabilities; and further comprising program instructions for: the second set of differences in vulnerabilities is the differences between the compiled third list of known vulnerabilities and the first list of known vulnerabilities minus the first set of differences in vulnerabilities between the compiled second list of known vulnerabilities and the first list of known vulnerabilities; The first period and the second period are equal. The system of claim 7.

9. The program instructions include: automatically analyzing each of the plurality of third-party software components identified in the software bill of materials for newly discovered vulnerabilities after a second period of time; storing a compiled third list of known vulnerabilities for said software application; comparing the compiled third list of known vulnerabilities with the compiled second list of known vulnerabilities; transmitting a second notification over the network identifying a second set of differences in vulnerabilities in response to the compiled third list being different from the compiled second list; and further comprising program instructions for: the second set of differences in vulnerabilities are differences between the third compiled list of known vulnerabilities and the second compiled list of known vulnerabilities; The first period and the second period are equal. The system of claim 7.

10. The program instructions for automatically analyzing each of the plurality of third-party software components identified in the software bill of materials for known vulnerabilities include: querying at least one external vulnerability database for known vulnerabilities for each of the third-party software components identified in the software bill of materials; including instructions to: The system of claim 7.

11. The program instructions for querying the at least one external vulnerability database for known vulnerabilities for each of the third-party software components identified in the software bill of materials include: querying a plurality of external vulnerability databases for known vulnerabilities for each of the third-party software components identified in the software bill of materials; including instructions to: The system of claim 10.

12. the plurality of external vulnerability databases include at least one of the National Vulnerability Database (NVD) maintained by the National Institute of Standards and Technology, the Sonatype open source security (OSS) Index, the GitHub Security Advisories (GHSA) database, the Snyk Vulnerability Database, or the Common Vulnerabilities and Exposures (CVE) database; The system of claim 11.

13. 1. A computer program product for continuously monitoring and reporting newly discovered vulnerabilities in third-party software components used in a software application, the computer program product comprising: a computer-readable storage medium having program code embodied therein; The program code receiving a software bill of materials (SBOM) for the software application that includes a plurality of third-party software components; automatically analyzing each of the plurality of third-party software components of the software bill of materials for known vulnerabilities to generate a first list of known vulnerabilities; storing the first list of known vulnerabilities for the software application; automatically analyzing each of the plurality of third-party software components identified in the software bill of materials for newly discovered vulnerabilities after a first period of time; storing a compiled second list of known vulnerabilities for said software application; comparing the compiled second list of known vulnerabilities with the first list of known vulnerabilities; transmitting, in response to the compiled second list differing from the first list of known vulnerabilities, a first notification over a network identifying a first set of differences in vulnerabilities between the compiled second list of known vulnerabilities and the first list; a computer program product executable by a processor to perform the steps of:

14. The computer program product comprises: automatically analyzing each of the plurality of third-party software components identified in the software bill of materials for newly discovered vulnerabilities after a second period of time; storing a compiled third list of known vulnerabilities for said software application; comparing the compiled third list of known vulnerabilities with the first list of known vulnerabilities; transmitting a second notification over the network identifying a second set of differences in vulnerabilities in response to the compiled third list differing from the first list of known vulnerabilities; and further comprising program code for: the second set of differences in vulnerabilities is the differences between the compiled third list of known vulnerabilities and the first list of known vulnerabilities minus the first set of differences in vulnerabilities between the compiled second list of known vulnerabilities and the first list of known vulnerabilities; The first period and the second period are equal.

14. A computer program product according to claim 13.

15. The computer program product comprises: automatically analyzing each of the plurality of third-party software components identified in the software bill of materials for newly discovered vulnerabilities after a second period of time; storing a compiled third list of known vulnerabilities for said software application; comparing the compiled third list of known vulnerabilities with the compiled second list of known vulnerabilities; transmitting a second notification over the network identifying a second set of differences in vulnerabilities in response to the compiled third list being different from the compiled second list; and further comprising program code for: the second set of differences in vulnerabilities are differences between the third compiled list of known vulnerabilities and the second compiled list of known vulnerabilities; The first period and the second period are equal.

14. A computer program product according to claim 13.

16. the program code for automatically analyzing each of the plurality of third-party software components identified in the software bill of materials for known vulnerabilities comprises program code for querying at least one external vulnerability database for known vulnerabilities for each of the third-party software components identified in the software bill of materials; 14. A computer program product according to claim 13.

17. the program code for querying the at least one external vulnerability database for known vulnerabilities for each of the third-party software components identified in the software bill of materials comprises program code for querying a plurality of external vulnerability databases for known vulnerabilities for each of the third-party software components identified in the software bill of materials; 17. A computer program product according to claim 16.

18. the plurality of external vulnerability databases include at least one of the National Vulnerability Database (NVD) maintained by the National Institute of Standards and Technology, the Sonatype open source security (OSS) Index, the GitHub Security Advisories (GHSA) database, the Snyk Vulnerability Database, or the Common Vulnerabilities and Exposures (CVE) database; 18. A computer program product according to claim 17.

Images