Improving Software Supply Chain Cybersecurity

Consider these key attack vectors:

Open source code

Mostly commonly, developers copy open source code from shared public libraries like Github to get everyday components. Why waste valuable time writing code to take a message from one field to another when someone else has already done it? The ease of use is why 90% of modern applications leverage open source code.

However, the unchecked nature of open source code can lead to crippling attacks like Apache Log4j, a widely used open source logging library. A critical flaw in the Log4j logging framework allowed cybercriminals to compromise vulnerable systems with just a single malicious code injection. It is estimated that Log4j impacted upwards of three billion medical devices that used Java, according to the FDA.

System management tools

Version control systems manage the actual release and deployment processes. Once in production, third-party and open-source production environments host the application. While the system is running, automated operations tools handle the routine business of maintaining service levels, starting and stopping scheduled activities, and synchronizing updates. A suite of systems management tools makes sure that production runs smoothly and resources are optimized.

Kaseya VSA, a popular tech management software, was hit with a REvil ransomware attack in early 2021. The attackers exploited a vulnerability in the update mechanism, enabling them to distribute a malicious payload through the hosts managed by the software. The damage from the widespread attack extended well beyond the virtual world, with a Swedish supermarket chain Coop forced to close 800 stores for almost a week.

Purchased applications

Developers also use purchased software products for things like updating a database, templating a web page, testing, and so on. These software products can be exploited by vulnerabilities, such as Ripple20, a series of zero-day vulnerabilities in a widely used low-level TCP/IP software library developed by Treck, Inc.

The impact of Ripple 20 was magnified by the supply chain; demonstrating how a single vulnerable component can ripple outward to affect a wide range of industries, applications, and companies including Fortune 500 multinational corporations. JSOF reported that the dissemination of the software library led to hundreds of millions of devices being impacted.

Remediating software supply chain cyber risk

Evidently, the software supply chain can be exploited at multiple points, which makes securing it increasingly complex. To help organizations strengthen defenses, CISA published ICT SCRM Essentials, recommending 6 key steps to building an effective supply chain risk management practice:

1. Identify: Determine who needs to be involved
2. Manage: Develop your supply chain security policies and procedures based on industry standards and best practices, such as those published by NIST
3. Assess: Understand your hardware, software, and services that you procure
4. Know: Map your supply chain to better understand what component you procure
5. Verify: Determine how your organization will assess the security culture of suppliers
6. Evaluate: Establish timeframes and systems for checking supply chain practices against guidelines

To optimize CISA’s framework, ensure your current security tools and vendors don’t slow or create additional barriers across each step. For example, you’ll need comprehensive visibility to not only discover and record all aspects of your digital attack surface, track updates and patches, and learn traffic patterns, but to also map all vendors or third parties who access your data and assets. This high level of visibility is necessary for any specific mitigation tactics, especially in today’s widening digital attack surface.

Look for a vendor with a unified cybersecurity platform that supports broad third-party integrations, ensuring total oversight from a single dashboard across the software supply chain. Security capabilities such as automation, continuous monitoring, and deep data collection and correlation are also vital to enabling faster detection, response, and remediation of affected supply chain components.

For more information about managing and mitigating cyber risk, check out the following resources: