97 Things Every Application Security Professional Should Know

Chapter 66. Secure the Software Supply Chain Through Transparency

Niels Tanis

At the beginning of my development career, I developed applications that were solely built and used inside of an organization and run on premises. That’s a big difference compared to today where software might be built and released several times a day and deployed to a cloud-based infrastructure. The development process has become a lot more complex. Starting with the source and then going through different stages like building, testing, and deploying artifacts (such as binaries or containers) can be referred to as the software supply chain.

Because the whole process has become more complex, and even turned into the software itself, it has become a main target for security attacks. This is because its overall attack surface has increased. For example, it can vary from stolen Git credentials from Canonical (the people behind the widely used Linux Ubuntu distribution) to the compromised build servers in case of the SolarWinds supply chain attack. In the latter case, it even resulted in the release of a product that was an authentic cryptographically signed installation to SolarWinds customers. It took some time and investigation to realize the hack happened, and people with malicious intent added additional functionality to it.

To secure our supply chain of applications in a better way, there is a need ...