PwC UK partners with ReversingLabs to bring software supply chain security to third-party risk management

Advisory {and professional} providers large PwC UK is partnering with safety agency ReversingLabs to develop a third-party danger administration (TPRM) platform to assist companies deal with software program provide chain safety dangers. Alongside ReversingLabs, the agency goals to assist clients modernize conventional TPRM packages to raised swimsuit the fashionable software program provide chain, operationalizing detection and mitigation of threats inherent in third-party software program. Software program provide chain dangers pose complicated and ongoing challenges for companies throughout the globe.

Alliance targets software program visibility, danger remediation, malware assaults

The brand new alliance combines PwC’s advisory capabilities and executive-managed service experience in TPRM packages with ReversingLabs’ automated platform to rapidly detect and mitigate threats inside software program, the companies mentioned in a press launch. The pair mentioned the partnership will assist clients:

• Improve visibility into software program: visualize the parts that make up the software program provide chain and the danger they current to the enterprise.
• Automate software program assurance testing: remove handbook questionnaire-based testing required for software program suppliers.
• Defend the software program provide chain end-to-end: cut back the probability and affect of malware and tampering assaults on the availability chain throughout the software program improvement and use lifecycles.
• Scale back dependencies on provider cooperation: acquire safety assurance over software program consumed utilizing only a binary bundle (no entry to supply code is required).
• Streamline danger remediation: prioritize safety remediation efforts to these essential danger points that the majority considerably affect a enterprise.

Software program provide chain safety approaches should evolve

“The best way companies should take into consideration their provide chain continues to evolve and it’s clear now that with such a excessive dependency on software program and expertise, getting visibility into software program safety is not a nice-to-have exercise,” mentioned Penny Flint, companion, PwC UK.

Trendy software program provide chain safety calls for that organizations not solely deal with points particular to the event of software program functions, but in addition to the consumption of business software program, the place suppliers’ reliance on exterior parts like third-party libraries introduces extra dangers, mentioned Mario Vuksan, CEO and co-founder, ReversingLabs. “Organizations have by no means been extra reliant on their provider base than they’re immediately. In consequence, automation is required to assist assess the danger of those relationships at velocity and scale,” Vuksan mentioned. “On the identical time, TPRM groups want options to not solely handle rising and current threats from the availability chain, however different challenges, together with regulatory scrutiny, entry to expertise, and the convergence of varied danger domains.”

Software program provide chain dangers proceed to affect companies

In October 2022, analysis from software program provide chain administration firm Sonatype revealed that the variety of documented provide chain assaults involving malicious third-party parts elevated by 633% over the earlier yr, reaching over 88,000 recognized situations. In the meantime, situations of transitive vulnerabilities that software program parts inherit from their very own dependencies reached unprecedented ranges, plaguing two-thirds of open-source libraries, in accordance with the analysis.

In March, the White Home launched an bold Nationwide Cybersecurity Technique that places better duty on US software program distributors to safe the software program ecosystem. “Too many distributors ignore greatest practices for safe improvement, ship merchandise with insecure default configurations or recognized vulnerabilities, and combine third-party software program of unknown or unvetted provenance,” the technique states. The administration is proposing to shift duty onto software program makers that fail to take affordable precautions to safe their merchandise and away from the tip customers who all too “typically bear the implications of insecure software program.”