Making the Case for SCA | Alyssa Miller | WWHF San Diego 2022

From Monoliths to Dependency Trees

Alyssa Miller, business information security officer and former developer, contrasts pre-2004 applications written entirely in-house with modern builds pulling transitive dependencies through Maven, npm, and similar package managers. Developers often cannot enumerate indirect libraries buried deep in dependency graphs.

Landmark Supply-Chain Breaches

Miller revisits Equifax's 2017 breach via an unpatched Apache Struts dependency nested below visible manifests, exposing 164 million consumers. She connects the pattern to Log4j in late 2021—present in 91% of Java apps per Snyk, often as unknown indirect dependencies—and Spring4Shell in 2022, showing the problem accelerating rather than resolved.

The Aviation Weight-and-Balance Analogy

Drawing on her pilot training, Miller compares software composition analysis to aircraft equipment manifests that track every component's weight and position for safe flight. Organizations need analogous visibility into third-party code affecting application center of gravity and risk.

Making the Case for SCA

The talk argues software composition analysis tools, accurate inventories, and developer integration are essential defenses. Without knowing what ships inside binaries, organizations cannot patch, prioritize, or insure against vulnerabilities in code they never wrote but implicitly trust.