The Rise of Continuous Packaging

Introduction

Software supply chain security is the subject of ever-increasing focus, and rightly so. Attacks on the supply chain have grown in number, and they are becoming an important way that threat actors can breach organizations and gain access to valuable, sensitive data. As software teams become more aware of security threats and internalize good habits to counter them, malicious actors have become smarter and begun to use legitimate software distribution and update mechanisms as their way in. More and more, software supply chain attacks take advantage of the trust that companies and users place in vendors, and the trust that developers invest in the code that they use from well-known public repositories and registries.

Modern cloud native software development depends more and more on libraries, packages, and other code provided by third parties. The CI/CD pipeline, which increases the effectiveness and speed of software development pipelines, introduces complexity into the software supply chain, from dependencies through the eventual deployment of a cloud native application into a customer’s infrastructure, whether on premises or in the cloud. With this complexity comes risk, as the many moving parts of the software supply chain offer a variety of targets for threat actors. By compromising packages and other dependencies, it’s possible to gain entry into the software development pipeline itself, inserting backdoors and other malicious code for use when the application ...