View Source

Contents:

Components Inventory

If you are a developer, you most probably will access to build systems where external components are “identified”.

But, are those 3^rd party components part of a “controlled” inventory? Most probably, don’t.

Kiuwan Insight analyzes your application software, discovering all external dependencies, and builds a Components Inventory that lets you track of any external piece of code that could be part of your application.

Supported languages and resources

Kiuwan Insights uses the following resources to extract information on 3^rd party dependencies.

Supported languages	Supported repositories	Supported build systems
Java	Maven Gradle	Ant Maven Gradle
Javascript	Npm Bower	Npm Bower Yarn
.Net	Nuget	Nuget
Python	PyPI GitHub	PyPI Requirements (txt file with declared deps)
Swift	Cocoapods GitHub	Podspec Package
Php	Packagist	Composer

From these sources, Kiuwan Insight builds the Components Inventory of your application.

Components Inventory is accessible trough Insights >> Components tab.

Insights >> Components

Insight >> Components tab displays Components Inventory:

Overall Information on Components – aggregated information on number and type of components
List of Components – detailed listing of components
Component detail – detailed information on selected component

kiuwan > Insights Components > Co_01.PNG

Overall Information on Components

kiuwan > Insights Components > Co_02.PNG

Number of components by language
Number of components by Security Risk level (High, Medium, Low and None)
Alerts :
- Components with High Security Risk
- Components being used with different versions that might be cause conflicts
- Etc.

List of Components

Kiuwan Insights provides a full listing of all those components being used by your application.

For every 3^rd party component, you will have access to detailed component information such as:

Component name and description
Used version(s)
Its filename (i.e. physical container) (.jar, .dll, .js, etc)
Programming language
Obsolescence risk (see Obsolescence Risk )
License risk (see Insights Licenses)
Security risk (see Security Risk )

kiuwan > Insights Components > Co_03.PNG

Security risk

A component’s Security Risk is based on CVSS v2 Base Scores (Severities) of its vulnerabilities:

If the selected component has more than one vulnerability, Kiuwan will label the component with the highest severity value of all the vulnerabilities of the component.
If the selected component has only one vulnerability, the Severity of that vulnerability will be the Security Risk of the component.

Please visit CVSS v2 for further information on CVSS v2 Base Scores (Severities) of vulnerabilities.

Obsolescence risk

A component’s Obsolescence Risk is a measure of the risk level relative to:

the antiquity of your version respect to the latest version, and
how active is the component

Both values are combined in the Obsolescence Risk to provide a value of the risk associated to using outdated or “dead” components.

Please visit Obsolescence Risk for further information on Obsolescence Risk.

License risk

A component’s License Risk is a measure of the risk level relative to legal implications of used components’ licenses.

Please visit Insights Licenses for further information on Licenses.

Component details

By clicking on a component, you will have access to the following information:

Description of the component
License of the component
Found vulnerabilities of the selected component:
- CVE identifier, and link to NIST National Vulnerability Database desc page
- CWE type, and link to MITRE Common Weakness Enumeration desc page
- Vulnerability description
- Severity (more on this at Security Risk )

kiuwan > Insights Components > Co_04.PNG

Duplicated components

With Kiuwan Insights you can identify different versions of the same component used by your application.

Below example shows that the analyzed application is incorporating two different version of ZKoss common library: 8.0.1 and 6.0.0

kiuwan > Insights Components > Co_05.PNG

Most probably, this component duplication is not intended, and it’s something that would produce maintainability headaches when upgrading to a newer version of the library.