![\"Software](\"https:\/\/solutionsreview.com\/enterprise-resource-planning\/files\/2023\/04\/Software-Supply-Chain-Security-Is-Going-Mainstream-in-2023.-Heres-How.jpg\")
<\/p>\n<\/p>\n
As part of Solutions Review\u2019s\u00a0Contributed Content Series<\/a>\u2014a collection of articles written by industry thought leaders in maturing software categories\u2014Tomislav Peri\u010din, the co-founder and Chief Software Architect at ReversingLabs<\/a>, outlines some of the reasons software supply chain security is going “mainstream” in 2023. <\/span><\/span>\u00a0<\/span><\/span><\/span><\/strong><\/em><\/p>\n Recent history is littered with tragedies that trace their roots to compromised or faulty supply chains. Whether it be the <\/span>Tylenol tragedy<\/span><\/a> in 1982, the <\/span>1986 Challenger Disaster<\/span><\/a>, or the (much) more recent <\/span>recall in the U.S. of over-the-counter eye drops<\/span><\/a> tainted with bacteria. <\/span>Software<\/span><\/i> supply chain risk is an entirely different matter. The dangers posed by compromised or substandard software modules have maintained a low profile within many organizations, even as those organizations’ reliance on software and cloud-based services through so-called “digital transformation” mushroomed in the last two decades. <\/span>\u00a0<\/span><\/p>\n However, things have changed. SolarStorm, <\/span>the 2020 attack that compromised<\/span><\/a> the software maker SolarWinds’ Orion software as well as other high-profile targets, led to an urgent reassessment of software supply chain risk by software development firms, their customers, as well as federal officials, and regulators. Attackers, be they cyber-criminal groups or nation-state actors, took note, as well. More than two years later, we are starting to see the byproducts of that shift in focus as software supply chain security emerges as a top area of concern and investment. <\/span>\u00a0<\/span><\/p>\n How do we know? Here are four signs that software supply chain security is going “mainstream” in 2023: <\/span>\u00a0<\/span><\/p>\n The continuing drumbeat of supply chain attacks and compromises is the most obvious sign that focusing on software supply chain security is no distraction.\u00a0<\/span><\/p>\n Since the beginning of 2023, several high-profile incidents stemming from supply chain compromises have occurred. Most recently, we witnessed <\/span>an attack on VOIP provider 3CX<\/span><\/a>, which saw malicious code pushed to the company’s customers via a signed update for the 3CX desktop client application. Then there was <\/span>the attack on CircleCI<\/span>, a continuous integration platform vendor that exposed private code repositories hosted on the platform to malicious actors.\u00a0<\/span>\u00a0<\/span><\/p>\n Other incidents, like the <\/span>accidental disclosure<\/span><\/a> of stored secrets by the continuous integration platform TravisCI or <\/span>successful red team attacks on application infrastructure used by automakers<\/span><\/a>, revealed how public and private code repositories and their secrets had become stepping stones to damaging attacks on applications and data. <\/span>\u00a0<\/span><\/p>\n Then there are the commodity attacks on open-source platforms<\/a>, including npm, PyPI, and NUGet, in which malicious actors plant thousands of malicious packages, many designed to sow confusion among developers. ReversingLabs has compiled data showing a nearly 300 percent increase in supply chain attacks on platforms like npm and PyPI over the last four years. Recent events show those <\/span>attacks spread<\/span><\/a> to smaller, less frequented repositories like NUGet for .Net developers.\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n Threats and attacks on software supply chains are also driving investment by platform vendors in securing developers and code. Among the advances in recent months: GitHub introduced<\/span> automated vulnerability scanning<\/span><\/a> for code hosted on their repository. Recently, GitHub owner Microsoft <\/span>integrated the OpenAi ChatGPT technology into CoPilot,<\/span><\/a> a code-focused AI chatbot that can speed development and help developers accelerate growth and avoid common coding mistakes. A r<\/span>ecently unveiled<\/span><\/a> Security CoPilot will help security teams spot emerging threats by helping make sense of threat intelligence, correlate threat activity, and make decisions “at machine speed,” Microsoft said. <\/span>\u00a0<\/span><\/p>\n Beyond that, GitHub has <\/span>made its secrets scanning and detection feature available for free <\/span><\/a>to public repositories hosted on the platform and strengthened account security for GitHub and npm account holders in ways that make it easier to implement two-factor authentication to protect developer accounts. By the end of 2023, GitHub will <\/span>mandate two-factor authentication (2FA)<\/span><\/a> for developer accounts.\u00a0\u00a0<\/span>\u00a0<\/span><\/p>\n Given the deep reliance on open-source code and robust coding and code-hosting platforms, including GitHub, npm, and PyPI, the steps taken by significant platform operators in recent months will have huge impacts on developer practices and behaviors as they offer evidence that the scourge of software supply chain threats and attacks prompt actions and investments from major players. <\/span>\u00a0<\/span><\/p>\n As much as the private sector drives innovation, the most salient moves to shore up the security of the software ecosystem and supply chains<\/a> in recent months have come from the federal government. There, a series of orders and regulations have turned up the heat on software producers who do business with the federal government to fortify the security of developed code and the software supply chains that support it. <\/span>\u00a0<\/span><\/p>\n First, there was the Biden Administration’s <\/span>Executive Order 14028<\/span><\/a>, issued in early 2021, and subsequent guidance, including the September memorandum <\/span>M-22-18<\/span><\/a> and <\/span>Enduring Security Framework practice guidelines<\/span><\/a> issued by the National Security Agency, the Cybersecurity and Infrastructure Security Agency, and the Office for the Director of National Intelligence. The federal guidance outlines specific goals and requirements for federal agencies and their software suppliers regarding software supply chain security. Those include using Software Bills of Materials (SBOMs) and adherence to <\/span>NIST Special Publication 800-218<\/span><\/a> on developing a secure software development framework and subsequent NIST guidance on software supply chain security.\u00a0<\/span>\u00a0<\/span><\/p>\n Finally, the recent publication of the Biden Administration’s National Cybersecurity Strategy began to shift the focus for securing software from end-users and individuals to software publishers, putting the onus for security on prominent players, the public and private sector, rather than continuing to blame the victims for breaches and adverse events. <\/span>\u00a0<\/span><\/p>\n Pushing software publishers to improve the security of their wares is a crucial part of all of these measures. Beyond handing down mandates, the Federal Government is taking steps to ensure those mandates turn into improved practices. For example, CISA has <\/span>created a Supply Chain Risk Management Office<\/span><\/a> to operationalize software supply chain best practices in federal agencies. Meanwhile, another federal department, Federal Acquisition Security Council, is developing a standard scorecard for federal agencies to assess their supply chain risk based on federal guidelines from NIST and others.\u00a0 <\/span>\u00a0<\/span><\/p>\n Finally, developers and development organizations are coping with the threats of sophisticated cyber-criminals and nation-state groups. They are bolstering their defenses and skills to counter that threat. Development teams spent years <\/span>focusing on identifying and fixing software vulnerabilities to<\/span> the exclusion of all else. Meanwhile, the use of open-source code and public code repositories continued to grow unchecked, with little thought given to its underlying security.\u00a0<\/span><\/p>\n Development organizations are becoming more aware and wary of the risks lurking in their code and broader software supply chains. Free, powerful, and ubiquitous software modules like Core-JS are suddenly <\/span>viewed differently<\/span>: as a cash-strapped, single-developer project runs out of a sanctioned country. Development organizations across the globe are increasingly asking not just “What is in our supply chain,” but also “Who is in our supply chain?”\u00a0 <\/span>\u00a0<\/span><\/p>\n At the same time, the parade of security incidents at significant platforms, and the resulting attention they receive, is raising developer awareness of long-recognized security risks. Platforms like npm and GitHub, long promoted as safe developer playgrounds, are now viewed as more ambiguous environments in which malicious actors troll for leaked credentials and threats lurk in the form of typo-squatted or corrupted packages, which can compromise entire development environments.\u00a0 <\/span><\/p>\n That, in turn, is shifting developer behavior towards safer practices\u2014abandoning “hard-coded credentials” while embracing the scanning and analysis of third-party packages, compiled binaries, and more. <\/span>This should pay big dividends. For example, our analysis of the 3CX r<\/span>evealed clear warning signs<\/span> in the compromised updates the company shipped to customers. More scrutiny of software artifacts post-build will surely derail some emerging supply chain attacks.\u00a0<\/span><\/p>\n Improving the quality and security of the software and services upon which our economy relies is truly a “boil the ocean” undertaking. The journey to a safer, more secure, more resilient software ecosystem has to start somewhere. Looking back, we may well decide that 2023 was an inflection point in that journey, when both the government and industry became serious about improving software security when the impact of that change in mindset finally began to show.\u00a0<\/span><\/p>\n As part of Solutions Review\u2019s\u00a0Contributed Content Series\u2014a collection of articles written by industry thought leaders in maturing software categories\u2014Tomislav Peri\u010din, the co-founder and Chief Software Architect at ReversingLabs, outlines some of the reasons software supply chain security is going “mainstream” in 2023. \u00a0 Recent history is littered with tragedies that trace their roots to compromised […]<\/p>\n","protected":false},"author":635,"featured_media":5563,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"inline_featured_image":false,"footnotes":""},"categories":[5],"tags":[2963,2813,2184,2814,2811,2812],"acf":[],"yoast_head":"\nSoftware Supply Chain Attacks are Spreading\u00a0<\/strong><\/h3>\n
Platform Operators Boost Supply Chain Defenses\u00a0<\/strong><\/h3>\n
The Federal Government is Looking to Regulate Software Quality\u00a0<\/strong><\/h3>\n
Development Teams are Wising Up\u00a0<\/strong><\/h3>\n
\n\t\t\t![\"Download](\"https:\/\/solutionsreview.com\/enterprise-resource-planning\/files\/2019\/06\/erp-third.jpg\" "\\"ERP")
<\/a> ![\"Download](\"https:\/\/solutionsreview.com\/enterprise-resource-planning\/files\/2019\/06\/merp-third.jpg\" "\\"MERP")
<\/a> ![\"Download](\"https:\/\/solutionsreview.com\/enterprise-resource-planning\/files\/2019\/06\/derp-third.jpg\" "\\"DERP")
<\/a><\/p>\n<\/div>\n\t\t<\/div><\/div><\/p>\n","protected":false},"excerpt":{"rendered":"