What is »kotlin-csaf«?
»kotlin-csaf« is an initial version of a software library that allows developers to process security information in the standardized CSAF format. This makes it easier to manage and validate security alerts and recommendations, which ultimately helps to make software more secure. The CSAF standard plays a critical role in cybersecurity by providing automated information to find and eliminate security vulnerabilities.
Integration with Dependency-Track: automated security checks, faster responses and more efficient compliance
The next step for Fraunhofer AISEC is to integrate »kotlin-csaf« into the Dependency-Track tool. Dependency-Track is a tool that reviews programs and their dependencies for security vulnerabilities. With the future integration of »kotlin-csaf« into Dependency-Track, companies will be able to
carry out automated security checks by processing security alerts and recommendations in a standardized format,
ensure faster responses to security incidents, as security information can be automatically created and consumed,
achieve more efficient compliance, as the Dependency-Track tool will then be more capable of meeting the requirements of the Cyber Resilience Act and the NIS 2 Directive.
Get involved: your feedback matters
»kotlin-csaf« is still in the early stages of development. Fraunhofer AISEC is continuously working to improve and expand the library. Therefore, we are looking for partners who are interested in working with us. Your input and feedback are crucial to making »kotlin-csaf« an even better cybersecurity tool.
»kotlin-csaf« library on GitHub: https://github.com/csaf-sbom/kotlin-csaf
Author
Christian Banse
Christian Banse holds a Master of Science in Business Information Systems with a focus on IT security from the University of Regensburg. He has been an employee at Fraunhofer AISEC since 2011. He was responsible for setting up a new type of network and cloud security laboratory, which he is now managing. This laboratory investigates research questions related to networks and IP-based communication. A particular focus is on research into methods for the automated and continuous certification of the IT security of cloud and container applications. Since mid-2018, Christian Banse has also been head of the Service and Application Security department.
