DevSecOps › Module 8 › Lesson 3
Dependency Risk
Dependency risk literacy — transitive depth, known CVE link, unmaintained package stub, license risk, upgrade path — risk rows on YOUR `$DEVSEC_LAB` dependency trees.
Visual · t36_dependency_risk
Dependency risk = named supply rows. $DEVSEC_LAB. Original Cyberlium.
Opening
Transitive dependencies hide CVE debt — name dependency risk rows on YOUR lab trees before typosquatting stranger org package feeds.
Dependency risk literacy names: transitive dependency depth category, known CVE link category (from SBOM/Trivy literacy), unmaintained package signal category, license compliance stub category, and upgrade/remediation path category. Analyst documents dependency risk register on `$DEVSEC_LAB` lab repo — three dependencies with risk row each — without publishing typosquat packages to public registries, without dependency confusion attacks on stranger orgs, without malicious package upload recipes. Cyberlium links SBOM to actionable risk — YOUR notes. Refused: typosquatting, dependency confusion attacks, malicious package guides. Lab row: dependency risk register (three deps, depth, CVE link, upgrade path).
1. Named risk rows
Transitive depth, CVE link, unmaintained signal, license stub, upgrade path — five literacy anchors.
Each dep links Module 8-2 SBOM component — same supply thread.
Command guide
Try these commands — Named risk rows
═══ DOCKER & CONTAINER AUDIT ═══
Check container running state and port bindings
Command — copy this
docker ps --format "table {{.ID}} {{.Image}} {{.Status}} {{.Ports}}" 2>/dev/null || echo "docker ps"Inspect container for elevated capabilities and root user
Command — copy this
docker inspect --format '{{json .HostConfig.Privileged}}' <container_id> 2>/dev/null || trueRun security vulnerability scan on container image using Trivy
Command — copy this
trivy image --severity HIGH,CRITICAL alpine:3.19 2>/dev/null || echo "trivy image alpine:3.19"
═══ KUBERNETES RBAC AUDIT ═══ Check current permissions in namespace
Command — copy this
kubectl auth can-i --list 2>/dev/null || echo "kubectl auth can-i"
Primary tools to practice this lesson: grep, python3. Reference sites: CISA SBOM (https://www.cisa.gov/sbom); NIST SSDF PS.2 (https://csrc.nist.gov/Projects/ssdf); Syft (https://github.com/anchore/syft). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Upgrade discipline
Upgrade path documented per risk row — lab or ticket path literacy.
Unmaintained signal cites last-publish date stub — not guesswork.
3. Refused
No typosquat packages; no dependency confusion attacks; no malicious upload recipes.
Risk literacy supports remediation — not supply chain offense.
4. What you ship: dependency risk register
Three deps + depth + CVE link + upgrade path + NEVER typosquat line.
5. What you record before the next lesson
Dependency risk register path.
6. Wrong vs right: stranger orgs vs YOUR repos
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Publish typosquat npm package mimicking popular library as 'dependency risk demo' on public registry.
Right
Dependency risk register from `$DEVSEC_LAB` lab repo. Next: Supply Lab.
Mission: dependency risk register
1) Name five dependency risk rows. 2) Three deps from lab tree. 3) CVE link and upgrade path each. 4) Write NEVER typosquat line.
Stuck? Ask Cyberlium AI Mentor
Ask Mentor: “Transitive depth — literacy triage threshold stub?”
Knowledge Check
APPLY: Dependency risk literacy uses:
Multiple choice
Knowledge Check
APPLY: True or False: Typosquat packages are course lab.
True or False
Knowledge Check
APPLY: Risk register includes:
Multiple choice