SPARTA strengthens European cybersecurity research through collaboration across the fields of science, technology, and the social sciences. The goal was to promote secure digital infrastructures and reliable data exchange. The project brought together European expertise, developed shared research approaches, and established a cybersecurity network. In doing so, it took into account social responsibility, data protection, and ethical requirements. SPARTA contributes to the sustainable and responsible advancement of digital security in Europe.

The CAPE Program

Within SPARTA, the University of Konstanz contributed to the CAPE (“Continuous assessment in polymorphous environments”) program. CAPE assesses cybersecurity properties in two areas: cyber-physical systems and complex systems of systems. For cyber-physical systems, it focuses on security-safety co-design, aiming to define security and safety requirements despite certification complexity jointly. For complex systems of systems, it addresses DevOps environments by expanding assessment over time and including external libraries and code.

The work group contributed to this effort in the area of data-driven security analysis, particularly through visual analytics approaches to support complex decision-making processes, i.e., for the impact analysis of open-source software vulnerabilities. Our goal was to guide security analysis in the decisions, whether to include a specific open-source library in there projects, and track the state of that dependency through the projects live-cycle.

Research Questions

• How can visualizations support the identification and comparison of vulnerable repositories across large software organizations?
• How can visualization tools help analysts assess organizational exposure caused by vulnerable open-source libraries?
• How can specific high-risk vulnerabilities, such as known CVEs, be efficiently identified across repositories, applications, and consumed libraries?
• How can vulnerability severity and organizational impact be visually represented to support prioritization and decision-making?

Selected Results

• In close collaboration with SAP, we developed the Vulnerability Explorer (VulnEx).
• VulnEx helps organizations to visually assess security exposure across projects by showing vulnerabilities (CVEs) originating from open source software dependencies on an organization-wide level.
• For an overview, the tool provides both a Tabular View for detailed vulnerability inspection and a Tree View that shows dependency structures as a directed acyclic graph, with impactful CVEs visually marked as red nodes.
• To enable engineers to focus on their projects’ exposure, the interface supports filtering repositories and modules by number of dependencies, number of CVEs, minimum/maximum CVSS score, and repository name.
• As a case study, all open-source Java projects from the Eclipse Foundation were crawled and scanned using Eclipse Steady to generate the demonstrator’s dataset.
• The case study with software security experts from SAP surfaced multiple critical and severe CVEs, impacting multiple dependent software products, while allowing prioritization based on CVE severity and project relevance.