Software Composition Analysis in the Automotive Industry

This chapter provides an overview of the current state of software composition analysis and discusses how such solutions can be applied in the automotive supply chain to improve software security. It reviews specific results from an analysis of several automotive software packages and discusses the associated risks of the identified open‐source components and known vulnerabilities. The chapter suggests best practices for managing open‐source software risks across the automotive supply chain. Best practices adopted by automotive organizations as a basis to manage open source software risks across the automotive supply chain are presented as follows: fully inventory open‐source software, use appropriate software composition analysis approaches, map open‐source software to known security vulnerabilities, identify license, quality, and security risks, create and enforce open‐source software risk policies, continuously monitor for new security threats, and define and follow processes for addressing vulnerabilities in open‐source software. These activities are explained in further detail.