Gnu Group Learning AcademyGnu Group ↗
DevSecOps Fundamentals · Module 06 of 12

Vulnerability analysis with SBOM and Grype

Use SBOM-driven vulnerability analysis while separating scanner confidence, fix availability, exploitability and exception policy.

Learning objectives

By the end of this module, you should be able to:

  • Scan an SBOM conceptually instead of repeatedly rediscovering inventory.
  • Build a triage record with fix and exposure context.
  • Explain why “no fix” needs risk treatment rather than automatic ignore.

Separate discovery from analysis

Generate component inventory once, then scan or rescan it as intelligence changes. This improves repeatability and incident response.

Prioritize with evidence

Severity, exploit evidence, reachability, network exposure, privileges, fix availability and compensating controls belong in triage.

Exceptions are temporary decisions

A vulnerability exception needs scope, reason, owner, expiry and revalidation triggers.

Worked example

Triage record

id=CVE-DEMO
component=demo-lib@1.2.3
severity=HIGH
reachable=yes
fix=1.2.4
owner=team-a
decision=fix-before-release
  • Connect each finding to a concrete risk and control.
  • Preserve evidence so a reviewer can reproduce the decision.
Core lab · account-free

Lab 06 — Apply vulnerability policy

Goal: Evaluate synthetic findings against a small release rule.

Before you start

  • No cloud account required.
  • Core lab uses bash/Python 3 and local files only.
STEP 1

Create policy input

cat > /tmp/vulns.json <<'EOF'
[{"id":"CVE-A","severity":"CRITICAL","reachable":true,"fix":true},{"id":"CVE-B","severity":"HIGH","reachable":false,"fix":false}]
EOF
STEP 2

Evaluate gate

python3 - <<'PY'
import json
x=json.load(open('/tmp/vulns.json'))
block=[v for v in x if v['severity']=='CRITICAL' and v['reachable'] and v['fix']]
assert [v['id'] for v in block]==['CVE-A']
print('block:',block[0]['id'])
PY
STEP 3

Define exception fields

For a deferred finding, require owner, reason, expiry and compensating controls.

Verify

  • The critical reachable fixed finding blocks.
  • Deferred risk is not silently ignored.

Expected outcome

  • Policy is explainable and reproducible.

Diagnose / troubleshoot

  • If a finding disappears after DB refresh, preserve previous evidence and explain the data change.
  • If an exception expires, fail closed or route to explicit reapproval.
Real-world connection

Security gates should encode organization policy while preserving room for accountable risk decisions.

Optional real-tool lab

Optional tool lab — Grype

Scan a Syft SBOM with Grype.

Prerequisites

  • Install the referenced open-source CLI only for the optional lab.
  • Use an organization-approved pinned version in real CI; do not blindly use latest.

Cost / risk

  • Expected cloud cost: none. Use only approved repositories and disposable training artifacts.

Warnings

  • Never scan or publish real production secrets in a training lab.
  • Scanner output is evidence for triage, not an automatic statement of exploitable risk.
TOOL 1
grype version
TOOL 2
test -s /tmp/syft.cdx.json && grype sbom:/tmp/syft.cdx.json || true
Avoid these traps

Common mistakes

  • Ignoring “no fix” forever.
  • Using scanner severity as the only business-risk input.
  • Losing the exact SBOM/scanner version used for a release decision.
Knowledge check

Can you connect the finding to the control?

Three concept checks plus one scenario check.

1Why scan an SBOM?

It separates inventory discovery from repeated vulnerability analysis and supports later rescans.

2What belongs in a vulnerability exception?

Scope, finding, reason, owner, expiry, compensating controls and revalidation trigger.

3Why record fix availability?

It changes remediation options and release decisions.

4Scenario: a reachable critical package has a fixed version available. What is a reasonable default gate?

Block promotion until fixed or an explicitly authorized time-bound exception is approved.

My Learning

Record your progress for this module.

Progress is saved in this browser immediately. When you sign in to My Learning, it can also sync across devices.

Not started

Attempt the core lab and knowledge checks before marking the module complete.