Fight Back Against Cyber Risk in the Software Supply Chain with a Secure and...- Krishna & Brendan

Introduction

In today's digital landscape, cyber risk has emerged as a significant concern, particularly within the software supply chain. With increasing threats and vulnerabilities, it's crucial to adopt a comprehensive approach to secure development practices. In this article, we will discuss how a secure and compliant DevSecOps pipeline can be a pivotal solution in combating these risks within regulated environments. This discussion will encompass the current landscape of software supply chain security, regulatory requirements, and our approach to developing a robust DevSecOps pipeline.

Understanding Cyber Risk

Cyber risks have the potential to compromise organizational infrastructure, damage reputation, and lead to substantial financial losses. Software supply chain security often remains underappreciated despite its critical importance. Statistics indicate that by 2025, around 45% of organizations globally are expected to experience attacks on their software supply chain, a significant increase from previous years. The average cost of a data breach stands at approximately $ 4.35 million, underscoring the need for robust security practices among software suppliers and Independent Software Vendors (ISVs).

The Regulated Environment Landscape

Regulated environments face heightened risks from various sources, including software supply chain attacks, open-source vulnerabilities, and compromised dependencies. To mitigate these risks, organizations must implement automated systems that prioritize security while managing compliance requirements effectively. Continuous integration, delivery, deployment, and, more recently, continuous compliance are fundamental components of this strategy.

Identifying Supply Chain Risks

The software development lifecycle encompasses several stages where security risks can emerge:

Development: Developers pushing code can compromise Source Code Management (SCM) tools, as demonstrated in cases like the Obja hack.
Build: Build platforms can also be vulnerable to attacks, with hackers potentially accessing API keys used within CI/CD systems.
Packaging: Vulnerabilities can arise if container registries, particularly public ones, are compromised.
Deployment: Continuous scanning is required post-deployment to identify any vulnerabilities that may surface after the code goes live.

The DevSecOps Pipeline Solution

Our approach to combatting these cyber risks involves a DevSecOps pipeline structured around three key components: Continuous Integration (CI), Continuous Deployment (CD), and Continuous Compliance (CC).

Key Principles:

Everything Defined as Code: Infrastructure, applications, pipelines, and compliance are codified for consistency and reusability.
Broad Language Support: The pipeline supports multiple programming languages while maintaining uniform testing approaches.
Shift Left Security: Security measures are integrated early in the development cycle to detect vulnerabilities before they reach production.

Continuous Integration:

In the CI pipeline, key features include:

Robust Code Review: Mandatory peer review of code changes.
Vulnerability Scanning: Utilizing tools like SonarQube and OWASP ZAP for static and dynamic security scans.
Signed Build Artifacts: Ensuring provenance and integrity of components deployed.

Continuous Deployment:

The CD stage implements:

Full GitOps-based Release System: Using git repositories as the source of truth for infrastructure and application configurations.
Change Management: A sophisticated change management system implemented to ascertain deployment readiness based on gathered evidence.

Continuous Compliance:

The CC pipeline continually scans for new vulnerabilities post-deployment and ensures that all artifacts meet regulatory compliance prerequisites.

Case Study: Buy-In

To illustrate the effectiveness of our DevSecOps approach, we examined a case study with Buy-In, a bank-oriented initiative focused on improving banking interoperability. Their deployment of a microservice architecture employed our CI/CD process, leading to improved compliance tracking and vulnerability detection.

Lessons Learned:

Utilize continuous compliance for improved tracking of vulnerabilities.
Emphasize vulnerability elimination while allowing for necessary exemptions.
Leverage shared libraries across multiple applications to enhance reusability.
Implement a centralized inventory for managing microservices.

Conclusion

The daunting task of reducing cyber risks within software supply chains can be accomplished significantly by refining development practices to include DevSecOps capabilities. Instituting a reliable and reputable automation framework, along with continuous compliance monitoring, are integral to this endeavor.

Join us for detailed sessions on our CI/CD processes as we continue to explore advancements in DevSecOps practices.

Keywords

Cyber risk, software supply chain, regulatory requirements, DevSecOps, continuous integration, continuous deployment, continuous compliance, vulnerability scanning, evidence locking, change management.

FAQ

1. What are the main components of a secure DevSecOps pipeline?
The main components of a secure DevSecOps pipeline include Continuous Integration (CI), Continuous Deployment (CD), and Continuous Compliance (CC).

2. How does continuous compliance enhance security?
Continuous compliance involves regular scanning of deployed artifacts for new vulnerabilities, ensuring adherence to regulatory requirements, and tracking exemptions when necessary.

3. What tools are used for vulnerability scanning in the DevSecOps pipeline?
Common tools include SonarQube for static code analysis and OWASP ZAP for dynamic application security testing.

4. How can organizations ensure their software supply chains are secure?
Organizations can ensure secure software supply chains by implementing a robust DevSecOps pipeline that emphasizes early detection of vulnerabilities, ongoing compliance monitoring, and utilizing signed build artifacts for tracking provenance.

5. What lessons were learned from the Buy-In case study?
The Buy-In case study highlighted the importance of continuous compliance, the need for vulnerability remediation processes, and the advantages of a centralized inventory for managing microservices efficiently.