Published on

Everything You Wanted to Know About Securing the Software Supply Chain but Were Afraid to Ask

Introduction

Introduction

In recent years, software supply chain security has become a top concern for organizations that produce and consume software. This article aims to enhance the collective understanding of the issue, engaging with important conversations about the past, present, and future of software supply chain security.

Speaker Introductions

The discussion began with introductions from the speakers:

  • Adele Ligari - Solution Architect Manager at Cloudsmith, an experienced system administrator with a passion for PowerShell and DevOps.
  • Paddy Cary - Engineer at Cloudsmith, with extensive experience in package managers and supply chain security.
  • Dan McKinney - Developer Relations at Cloudsmith, who has transitioned from systems engineering and holds interests in retro computing.
  • Dan Lawrence - Founder and CEO of Chainguard, with a history at Google focusing on open-source software security.

Background on Cloudsmith and Chainguard

Cloudsmith is a cloud-native package management solution that emphasizes securing the software supply chain. Chainguard, a newer company, focuses on open-source tooling to help organizations adopt secure software development practices by default.

Degrees of Concern

The conversation acknowledged the significant concerns surrounding software supply chain security, emphasizing the following significant events that have heightened these concerns:

  1. SolarWinds Attack (December 2020): This breach highlighted the vulnerabilities in software supply chains as attackers were able to insert malicious code undetected, affecting prominent companies like Microsoft and Intel.

  2. Dependency Confusion (February 2021): A security researcher demonstrated that attackers could exploit dependency management systems to inject malicious packages by creating public packages that matched the names of widely used private packages.

  3. Executive Order 14028 (May 2021): The U.S. government stressed the importance of cybersecurity, leading to regulations that encourage organizations to improve their software supply chain security.

Challenges in Addressing Supply Chain Security

The conversation delved into why securing the software supply chain is challenging, including the complexity of automated CI/CD pipelines, different attack vectors, and the need for enhanced visibility and alerting within these processes.

Tools and Projects for Security

Two important projects discussed were:

  • Sigstore: A tool that provides a free certificate authority for signing software artifacts, improving the ease of verifying software integrity.
  • Cosign: A tool contributed by Sigstore, allowing the signing of container images and artifacts stored in OCI registries.

Organizational Commitment to Security

Both Cloudsmith and Chainguard emphasize the importance of equipping organizations with security tools that are user-friendly and integrated with existing workflows. Encouraging open-source collaboration and maintaining a transparent supply chain is crucial for building trust among consumers.

Best Practices for Consumers

Consumers of software, especially those using sandbox containers or images, should follow best practices such as:

  • Conducting scans for vulnerabilities within the images.
  • Checking signatures and hashes to ensure artifacts have not been tampered with.
  • Building a proactive relationship with vendors to expect and demand security features as a standard.

Conclusion

The overarching message was clear: securing the software supply chain is not a simple checkbox exercise but an ongoing journey requiring collaboration across the tech community.

Keywords

  • Software Supply Chain
  • Security
  • SolarWinds Attack
  • Dependency Confusion
  • Executive Order 14028
  • Sigstore
  • Cosign
  • Best Practices

FAQ

Q1: What is the significance of software supply chain security?
A1: Software supply chain security focuses on protecting the software and its components from malicious attacks and vulnerabilities throughout the development and deployment processes.

Q2: What major events have influenced increased awareness of software supply chain security?
A2: Key events include the SolarWinds attack and the Dependency Confusion incident, which demonstrated vulnerabilities in existing security practices.

Q3: What tools are available to help secure the software supply chain?
A3: Significant projects include Sigstore for signing software artifacts and Cosign for managing container image security.

Q4: What role do organizations like Cloudsmith and Chainguard play in software supply chain security?
A4: These organizations develop tools and practices that help integrate security into the software development lifecycle, emphasizing open-source contributions.

Q5: What best practices should consumers of software follow?
A5: Consumers should scan for vulnerabilities, check signatures, and build relationships with vendors to ensure they receive secure software as a standard practice.

Read More