Question

A software team at a healthcare ISV builds a patient-portal web application using dozens of open-source npm and NuGet packages. Recent audits found that vulnerable third-party dependencies were shipped to production because developers manually reviewed only their own code. As the cybersecurity architect, you must design a secure development lifecycle control that prevents known-vulnerable open-source components from being promoted to release, while giving developers early feedback in their pull requests. Which control best meets this requirement?

Accepted Answer

Integrate GitHub Advanced Security Dependabot (software composition analysis) into the repository and add a CI pipeline gate that fails builds containing packages with known critical vulnerabilities.

Answer

Enable Microsoft Defender for Cloud's agentless VM vulnerability scanning on the production web servers.

Answer

Deploy Azure WAF with managed OWASP rule sets in front of the patient portal to block exploit attempts at runtime.

Answer

Require the team to run manual penetration tests against the staging environment before every production release.