What is software supply chain security?

In response to software development organizations taking more steps to secure their applications, attackers have had to get more creative in their own methods. The sharp and continuous rise of code reuse and cloud-native approaches have provided them with additional angles to mount attacks several degrees of separation away from their intended targets. Exploiting just one weakness opens the door for a threat actor traverse down the supply chain where they can steal sensitive data, plant malware, and take control of systems – something we’ve seen plenty of examples of in recent times.

In light of the uptick in security breaches, President Biden issued an executive order directing the heads of several federal organizations to create additional security guidelines surrounding the software they consume and operate. Aimed at bolstering the U.S.’s cybersecurity profile, this order has prompted a nationwide re-examination of organizational security practices that stretches well beyond those specified at the federal level. 

Solar Winds, a major U.S. IT firm, fell victim to a supply chain recently. Weak information security practices by a former intern exposed a critical internal password (solarwinds123). Once the password was compromised, suspected Russian hackers were able to access a system that SolarWinds used to assemble updates to Orion, one of its flagship products. From here, the attackers inserted malicious code into an otherwise legitimate software update, allowing them to monitor and identify running processes that were involved in the compilation of Orion, and replace source files to include SUNBURST malware. Orion updates were deployed to an estimated 18,000 customers, and SUNBURST sent information back to the attackers that was used to identify targets of additional malware, broadened access, and spying. The fact that the intended targets and victims of the attack were several degrees of separation away from the entry point, makes this a popular example of a modern software supply chain attack. 

There are key supply chain security practices and approaches you can take to lessen your supply chain security risk.

• Assess the security and trustworthiness of the code that you consume
  
• Ensure developers are keeping writing secure proprietary code
• Securely build and deploy code
• Harden data transfer methods used by applications
• Continuously test and monitor deployed applications for threats
• Provide consumers with an SBOM

Black Duck^® SCA provides complete visibility into your software supply chain by automatically identifying security, quality, and license compliance risks from open source and third-party code in applications and containers. Black Duck uses multiple scanning technologies to identify open source dependencies and offers prioritization and remediation guidance with insights and actionable alerts around vulnerabilities, license risk, component health, and malware detection. Black Duck simplifies Software Bill of Materials (SBOM) management with importing and exporting capabilities that enable teams to align with customer, industry, and regulatory requirements and comply with SBOM standards, such as SPDX and CycloneDx formats.      

Coverity^® Static Analysis is a fast, accurate, and highly scalable static application security testing (SAST) solution that helps development and security teams address security and quality defects early in the software development life cycle (SDLC), track and manage risks across the application portfolio, and ensure compliance with security and coding standards. Coverity enables you to seamlessly secure your proprietary code and guarantee infrastructure-as-code security so that your proprietary code isn’t the weak link in the software supply chain.

Continuous Dynamic^™ delivers fast and easy dynamic application security testing (DAST), optimized for developer needs. It systematically tests all the access points of your web applications through a headless browser to intercept and analyze JavaScript and AJAX requests, even as newly created forms are populated. It checks for the OWASP Top 10 web application security risks as well as other known security weaknesses and vulnerabilities, providing step-by-step instructions on how to eliminate any detected issues. Monitoring application behavior is a critically important way to ensure you are protecting yourself from potential supply chain threats. 

- This glossary was verified by Mike McGuire.