Software supply chains: A breeding ground for cybercrime

As the first segment of the software supply chain series, this blog shares a primer on what software supply chains are, why they can lead to security breaches, and how to safeguard them.

Wha are software supply chains?

Software supply chains integrate organizations, individuals, and systems that develop, produce, and distribute software. Their complexity and moving parts make them vulnerable to security attacks since attackers can exploit weak chain links to access sensitive data or inject malware. Moreover, modern cloud-native applications involve dynamic supply chains with many distributed components, which makes securing software supply chains even more complex.

Key components of a software supply chain

In a typical software supply chain, there are the following components:

1. Source code management
2. Continuous integration and delivery (CI/CD)
3. Automated testing
4. Containerization and virtualization
5. Artifact repositories
6. Configuration management
7. Deployment automation
8. Monitoring and logging
9. Security and vulnerability scanning
10. License compliance management

What are the points of attack?

Software supply chains link together and build upon components at every stage, starting from creation, deployment, management, monitoring, and compliance of software, hence the name Software Supply Chain. Therefore, software supply chains have several functional stages, as shown in Figure-1 below, and each step has the potential for an exploit.

What are the types of software supply chain attacks?

Software supply chain threats include, but are not limited to:

• Malicious code injection: Insert malicious code into the software during the development or distribution stage leading to serious security breaches and data theft.
• Tampering with updates: Attackers can modify software updates to include malicious code compromising the security of the software and leading to data theft.
• Unauthorized access to the code repository: Attackers can gain access to the code repository and make changes to the software code, leading to security vulnerabilities.
• Compromised third-party libraries: An attacker may gain access to the code repository and make changes to the software code.

What can be done to prevent software supply chain attacks?

Preventing supply chain security attacks involves implementing various security measures throughout the software development lifecycle, from design to deployment and upgrades. Here are some steps you can take to prevent attacks on your software supply chain:

• Establish security policies and standards: Access control, authentication, data validation assessment, and protection.
• Verify the integrity of software: Digital signatures, checksums, or other methods.
• Secure build environment: Secure build system access, secure software repositories, scan-build artifacts, and images for vulnerabilities.
• Run security assessments: Analysis to identify vulnerabilities and weaknesses in the software, including static and dynamic code analysis and vulnerability scanning.
• Use trusted sources: Use trusted sources for software and components, such as official repositories, verified vendors, and licensed and verified versions.
• Implement security controls: Use firewalls, intrusion detection systems, and access controls to protect against attacks.
• Monitor and respond to security incidents: Monitor vulnerabilities and security incidents and respond quickly to any incidents to minimize the impact.
• Foster a security culture: Easy-to-use tools for training employees on secure coding practices, password management, content analysis, and incident response.

We should also remember that supply chain attacks also target service providers. Today, businesses must work with suppliers; however, an attack on a supplier means an attack on the entire industry. As a result, Software Supply Chain Security plays a vital role in the health and operation of an organization.

What tools and technologies are available for software supply chain security?

SBOM (Software Bill of Materials) generators and vulnerability scanners are critical supply chain security tools. Leveraging and integrating these tools with your CI/CD pipelines is crucial for cloud-native containerized environments.

• SBOM Generators: These tools create a comprehensive list of all the components and dependencies of a software application. This information can help organizations identify and manage potential security risks in the software supply chain. By understanding the composition of their software, organizations can better track vulnerabilities, prioritize patches and updates, and respond more quickly to security incidents.
• Vulnerability Scanners: These tools can help organizations identify potential risks before attackers can exploit them. By regularly checking their software applications, organizations can identify and prioritize the most critical vulnerabilities, patch or remediate them, and reduce their overall risk of a security breach.

SBOM generators and vulnerability scanners can help organizations better understand the security risks in their software supply chain and take proactive steps to address them. By combining these tools with other security measures, such as access controls, containerization, and secure coding practices, organizations can improve the overall security of their dynamic supply chains and reduce the risk of a security breach or supply chain attack.

There are a bunch of commercial offerings, large enterprises, unicorns, and even some excellent open-source options and open standards available to help you carefully craft your software supply chain security. 

Here are a few options to consider:

Commercial Offerings

• Panoptica
• Anchore
• Aqua
• Chainguard
• Cycode
• Scribe
• Ox

Open-Source Options

• KubeClarity
• Trivy
• Grype
• Syft

Useful Standards

• CycloneDX
• SPDX
• CIS
• BISMM
• SAFECode
• NIST SP800-161
• ISO/IEC 27036-3:2013
• ISO/IEC 27034-1:2011

What makes Cisco relevant 

KubeClarity is an open-source project started by Cisco. Panoptica, a commercial SaaS offering from Cisco, also powers KubeClarity. KubeClarity integrates with and features a superset of the functionality offered by other open-source solutions like Trivy, Syft, and Grype. KubeClarity can therefore be an effective tool in your supply chain defense arsenal. We will learn more about it in subsequent blogs.

A summary of software supply chain security

Putting it all together, a mindmap of the software supply chain summarizes what it is, what it is not, and where it is valuable.

Next up: Software supply chain case studies

Continuing our series, let's examine a few case studies of real-world supply chain attacks demonstrating the importance of securing supply chains and the know-how of the right defense strategies and tools.

Pallavi Kalapatapu is a Principal Engineer and open-source advocate in Cisco’s Emerging Technology & Incubation organization.