(MENAFN- ValueWalk)
/ Pixabay Table of Contents
What Is Supply Chain Security?
Software supply chain security helps protect all components, processes, and activities related to . The software encompasses the entire software development life cycle (SDLC), including proprietary and third-party code, interfaces and protocols, development practices and tools, infrastructure and deployment methods, and physical components.
Get Our Activist Investing Case Study!
Get the entire 10-part series on our in-depth study on activist investing in PDF. Save it to your desktop, read it on your tablet, or print it out to read anywhere! Sign up below!
Fund Manager Profile: Kris Sidial Of Tail Risk Fund Ambrus Group
A decade ago, no one talked about tail risk hedge funds, which were a minuscule niche of the market. However, today many large investors, including pension funds and other institutions, have mandates that require the inclusion of tail risk protection. In a recent interview with ValueWalk, Kris Sidial of tail risk fund Ambrus Group, a
Development teams are responsible for securing the supply chain of software products and providing proof of security efforts to consumers. Supply chain security is a core part of supply chain management focused on the risks inherent to managing external vendors, suppliers, transportation, and logistics.
Why Is Supply Chain Security a Risk to the Global Economy?
Daily supply chain operations can be complex, requiring services and products to reach their target on time. Anything that interferes with a process can result in significant operational, financial, and reputational damage.
Modern supply chains have a large surface area, increasing the risk of security vulnerabilities throughout the supply chain stages. Security incidents affecting third-party suppliers or vendors can impact other companies in the supply chain.
Vendors must provide more flexible and accessible security controls to address shortages in skilled labor, risks associated with affordable services, and high connectivity. Here are some of the types of organizations that must consider supply chain security:
- Hospitals and healthcare providers —smart technologies and platforms access and process healthcare data more efficiently.
- Retailers —external vendors often enable the fast delivery of services and products.
- Manufacturers— these organizations often outsource security activities.
- Chemical companies —often hire external engineers to supplement the limited in-house workforce and skills shortages.
The hyperconnectivity between third parties helps accelerate growth but makes organizations dependent on external providers to ensure security. In some cases, they might not know their dependencies, making it harder to secure the supply chain.
Supply chain protection requires understanding how their data security controls work and where they extend, as well as how effective their gateways and risk management processes are. Managing supply chain risks can be challenging, but it is possible—it involves incorporating supply chain management processes into the general risk management strategy.
How to Ensure Supply Chain Security
The following best practices can help secure an organization's supply chain and prevent attacks that exploit third-party access.
Inventory Assets and Access Privileges
Organizations must have an up-to-date, detailed asset inventory. This step includes recording specifications for all hardware, software, patches, updates, and traffic patterns. Achieving high visibility is essential for mitigating attacks on specific supply chain components, especially in distributed environments with remote access.
However, securing the supply chain requires an additional dimension—the security team must also inventory access privileges and behavioral patterns to track users. Many companies fail to identify and map all external users accessing their corporate assets and data, such as suppliers and vendors, resulting in a security management blind spot.
Asset and access inventories are essential for measuring threats and tracking user credentials. Another way to strengthen data privacy and security is to manage access privileges using clear, temporary parameters.
Use Automated Security Testing Tools
Here are popular automated testing tools that can help strengthen software supply chain security:
Software composition analysis (SCA)
can identify known vulnerabilities in open source code and provide remediation guidance. Since open source components have become a staple of modern software development, SCA solutions have become a core part of security stacks.
Static application security testing (SAST)
Teams can apply SAST tools early in the SDLC to find issues in static source code. SAST is a white box technique that analyzes proprietary code, while SCA scans the code to locate open source components.
Dynamic application security testing (DAST)
DAST tools look for security issues in applications running in production or testing environments. DAST tools can find attack vectors such as SQL injections (SQLi), cross-site scripting (XSS), and operating system injections.
Prepare for Dependency Confusion Attacks
Most modern software development involves assembling a product from various open source components and packages rather than writing code from scratch. There are clear advantages to leveraging the expertise and labor of a large developer community, but this also creates a reliance on third parties, which in turn rely on other third parties. Dependencies have more dependencies, with a long chain of trust stretching that can be difficult to track.
The main cybersecurity risk associated with long dependency and supply chains is dependency confusion or chain-of-trust exploits. Malicious actors can perform dependency confusion by identifying inward-facing dependencies in the software's bill of materials and creating malicious packages with the same name—the attacks push the packages to public registries.
Eventually, attackers can exploit an organization's behavior management system to replace failed components with malicious code. These systems work by finding missing dependencies in the environment where the code tries to execute, often defaulting to a public registry to pull code.
The main way to prevent these attacks is to educate developers about dependency confusion risks. Many developers are unaware of these silent attacks. Another measure involves designating the specific registry source in the bill of materials and scanning for dependency name exposures.
Improve Third-Party Risk Management
Organizations should extend risk management strategies across third parties using various means. For example, including security policies in vendor contracts can help set parameters around data lifecycle management, notification, and assessment requirements and create a cultural baseline for inter-organizational security collaborations.
Organizations should also require vendors to validate their security posture by performing penetration testing, evaluating security ratings, and complying with regulations like the GDPR and the Cybersecurity Maturity Model Certification.
Conducting ongoing risk assessments and incorporating inspections, simulations, and questionnaires can help test incident response capabilities and verify vendors are to respond timely and effectively during security incidents.
Conclusion
In this article, I explained why the software supply chain poses a risk to the global economy. Organizations that provide critical services - including hospitals, manufacturers, and food retailers - all run their operations with the help of software, which can contain unknown or insecure components. To protect against these risks, organizations can take several measures:
- Inventory assets and access privileges - ensure all components of the supply chain are well understood and have the minimum possible privileges.
- Use automated security testing tools - test components for vulnerabilities and remediate or replace if issues are found.
- Prepare for dependency confusion attacks - take steps to prevent malicious attackers from replacing elements of the supply chain with malicious software.
- Improve third-party risk management - ensure that all third parties (vendors, contractors, and service providers) are carefully reviewed to identify risks.
Hopefully, by taking responsibility for supply chain security and implementing these and similar measures, organizations can reduce the risk to their own operations and to society at large.
MENAFN03102022005205011743ID1104964384