Lessons From the Largest Software Supply Chain Incidents

COMMENTARY

In 2011, Marc Andreessen coined a phrase we’re now all accustomed to: “Software program is consuming the world.” Greater than 13 years later, the expression nonetheless rings true. The world runs on software program, and every day it continues to remodel industries and gas the worldwide financial system. Firms are producing extra software program — sooner than ever earlier than — with a view to sustain in right now’s dynamic and ultracompetitive enterprise panorama.

Innovation is a lovely factor, however the elevated quantity and velocity with which software program is being constructed and delivered creates extra alternatives for one thing to go flawed within the software program provide chain. Over the previous decade, we have seen this occur time and time once more.

Round this time final 12 months, Okta disclosed that it had skilled a major safety breach, the place dangerous actors gained entry to personal buyer information by way of its assist administration system, highlighting the risks of third-party threat. In 2020, the SolarWinds platform replace mechanism was compromised and used to ship malicious software program that impacted greater than 18,000 of its clients. And again in 2017, Equifax suffered an enormous breach attributable to a failure to patch a identified safety flaw in its software program.

That is only a small sampling of the sorts of software program provide chain assaults which have plagued organizations over the previous decade. Sadly, these assaults present no indicators of slowing down — fairly the alternative, really.

Analysis signifies software program provide chain assaults are occurring at a charge of 1 profitable assault each two days, and Gartner predicts that by 2025, 45% of organizations may have skilled a software program provide chain assault. Alarmingly, one report discovered that there was a staggering 742% improve in these assaults over the previous three years.

The uptick in software program provide chain assaults could be attributed to a mix of a number of elements. Usually, organizations merely do not realize the breadth of their publicity. As software program retailers transfer towards extra refined software program supply and consumption fashions (e.g., steady integration/steady supply [CI/CD] and cloud), their provide chains turn out to be extra susceptible. Moreover, typical assault vectors have turn out to be more and more tough to take advantage of (due to distributors incorporating extra refined safety measures into platforms and software program), which has compelled dangerous actors to uncover new vulnerabilities and turn out to be extra inventive of their assaults. Extra just lately, the spike in adoption of generative AI (GenAI) instruments like coding assistants has created new and difficult-to-monitor safety gaps. On the similar time, attackers are leveraging GenAI themselves to hold out extra refined assaults at a better quantity.

Enterprises should urgently discover a stability between creating and releasing high-quality software program shortly, whereas upholding a excessive degree of safety at every hyperlink within the software program provide chain.

This is how they’ll keep safety with out impeding innovation:

Totally Vet Distributors on an Ongoing Foundation (and Deal with GenAI Instruments With the Similar Degree of Scrutiny)

If something could be realized from Okta’s breach, it is that third-party distributors have to be rigorously vetted in the event that they’re to be trusted with personal buyer information and different delicate info. Too usually, improvement retailers assume that the third-party code they devour is a black field.

Organizations want to take a look at every vendor’s software program invoice of supplies (SBOMs) so that they’re conscious of any open supply or third-party parts of their code and might subsequently determine potential vulnerabilities. They need to additionally assess the seller’s monitor document for safety and evaluation its insurance policies, procedures, and certifications.

Vetting distributors should not be a field the group checks in the beginning of their engagement after which forgets about. The vetting course of have to be ongoing: Organizations ought to frequently be asking questions and preserving a pulse on the seller’s new choices, insurance policies, compliance certifications, and extra.

Of word, GenAI instruments must be subjected to the identical degree of scrutiny as third-party distributors. Organizations want visibility into how the massive language mannequin (LLM) works, what information it was skilled on, whether or not the mannequin is open or closed, and the way consumer inputs and generated content material are collected and used. They’re going to additionally have to assess the accuracy and high quality of the code the LLM generates, in addition to have a plan in place to mitigate any inaccurate or buggy code it produces.

Eat Open Supply Tasks Fastidiously

Open supply tasks are important for fast improvement and innovation, however organizations must be very cautious about how they devour open supply code. Final 12 months alone, researchers discovered 245,032 malicious packages in open supply tasks out there for public obtain. Open supply repositories are a first-rate goal for dangerous actors, who can wreak havoc by attacking a single package deal that, in flip, impacts a whole ecosystem of corporations and their clients.

Organizations ought to use code solely from open supply tasks that adhere to strict compliance frameworks, such because the OpenSSF Scorecard, System Package deal Information Trade (SPDX), and OpenVEX. This ensures they’ve visibility into the safety hygiene of the venture earlier than they borrow its code. Moreover, organizations ought to undertake a software program composition evaluation (SCA) answer and have a plan in place to handle any open supply vulnerabilities, ought to they emerge.

Consider the Safety of Your Whole Software program Supply Course of

There is not any silver bullet for securing the software program provide chain. Organizations should diligently consider the safety of every step of the software program supply course of — together with design, improvement, testing, deployment, upkeep, and past.

By infusing safety measures all through the CI/CD pipeline, corporations can determine and remediate vulnerabilities early within the improvement course of so they do not result in a full-blown breach down the road. They will accomplish this by way of automated safety options that flag potential points and supply composition evaluation (SCA) instruments that scan code for identified vulnerabilities, and by implementing supply code entry controls to stop unauthorized entry.

The safety cat-and-mouse recreation is rarely over. Because the trade works diligently to increase its data and strengthen safety, attackers are simply as onerous at work planning and finishing up nefarious actions. The software program provide chain is a rising goal, and organizations have to take particular care to safeguard it. By rigorously vetting distributors, mindfully consuming open supply, and securing your complete software program supply course of, organizations can strike a stability between driving innovation and sustaining software program provide chain safety.