Resilience in software development Greater security through robust software supply chains

Related Vendors

GitLab GmbH

FAULHABER Drive Systems

dataTec AG

Wuxi InfiMotion Technology Co., Ltd.

For secure software development, having an overview of the components used and continuous monitoring are essential. Josh Lemos, CISO of GitLab, provides tips for "security by design."

From the attempted backdoor in XZ Utils to the takeover and subsequent distribution of malware in the Polyfill JS project: attacks on the software supply chain pose a serious challenge for the DevSecOps community. They can surprise even the most experienced experts. These incidents show that attacks on the software supply chain are inevitable and have the potential for serious consequences.

To strengthen their resilience, companies should consider three key components in their software development environments: transparency, governance, and continuous deployment. This way, companies can improve their defenses and reduce the time it takes to recover from the next cyberattack.

Visibility in dynamic systems

A security expert's knowledge of the software systems they protect is usually both limited and time-bound. The information that flows into processes is a snapshot of highly dynamic and complex computer systems, while the snapshots of security controls serve as time-limited references for the security status. Although artificial intelligence makes some security controls more dynamic and flexible, most security boundaries remain static or are based on heuristic approaches.

Conversely, the number of unknowns in large-scale computing environments is almost unlimited at any given time. Code is updated hundreds to thousands of times daily, infrastructure changes can nullify previously defined security boundaries, and upstream dependencies can have massive impacts on security.

To be prepared for the next attack, security experts must monitor their environments in real-time and minimize the number of unknown variables. For example, the use of a Software Bill of Materials (SBOM) is crucial for both commercial and open-source software (OSS). It provides a comprehensive overview of the components used in the software and enables the quick identification of vulnerable components when new threats arise. Such inventories serve as a canonical source for each asset, indexing and supporting extensible APIs and queryable interfaces to maximize their utility and value.

Knowledge about the age of the software in use can also help in developing security measures. Older services are more susceptible to third-party attacks or vulnerabilities because they are not deployed or maintained as frequently. On the other hand, new software is more prone to "first-party" issues like business logic errors or, less commonly, entirely new types of attacks. The combination of new and old software carries risks, especially if security measures have either just been defined or are already obsolete.

Control and management of software supply chains

Understanding a company's software systems is often not enough. Solid governance—a framework of policies, processes, and controls that ensure secure practices and are overseen by company management—is essential for maintaining security measures and accountability throughout the software lifecycle.

When developing "secure-by-design" software, there are several considerations:

• Creation of reproducible software and maintenance of service-specific metrics to ensure security

• Regular checks to ensure proper security prerequisites are in place,

• Use of pre-built infrastructure-as-code templates

• Building SBOMs (Software Bill of Materials) that can be used by teams for security operations and vulnerability alerts, as well as appropriate tools

• Automation of security checks to ensure compliance with "secure-by-default" principles

• Integration of AI validation into the SDLC (Software Development Life Cycle) to increase efficiency, reduce errors, and gain deeper insights into the development process

• Implementation of policy-as-code to automate the management and enforcement of security policies for cloud services, applications, networks, and data to ensure consistent and comprehensive security coverage

• Design of security boundaries through proper design, limiting areas of failure

Companies could also consider establishing an Open Source Program Office (OSPO) to enhance OSS security. These teams manage OSS usage, monitor security practices, maintain relationships with the open-source community, stay informed about the latest security and compliance developments, and oversee the reliability and security of open-source components.

Continuous assessment anticipates the unknown

Continuous testing and monitoring of a software environment are crucial for a company's resilience against vulnerabilities in the software supply chain. In continuous deployment, code changes are automatically tested and, upon successful passing of the tests, directly deployed to production—often hundreds to thousands of times a day. It goes beyond traditional integration and deployment by automating the entire process to improve software quality and accelerate delivery. However, continuous deployment is only possible if the necessary components for transparency and governance are in place.

Many developers find writing tests challenging, and test coverage is often less than what would be possible under optimal time conditions. Comprehensive test coverage, including unit and integration tests, ensures that every part of an environment is checked for errors both in isolation and in conjunction with other components. In this area, generative AI (GenAI) can be a great help by automating or accelerating the tedious work. This benefits development teams not only in terms of speed but also through continuous verification of the security and resilience of their software.

The automated review of security boundaries also ensures that they are seamless and well-maintained, serving as the first line of defense against potential breaches. Monitoring production environments can detect discrepancies or unexpected behaviors that might indicate a security issue. Finally, continuous programmatic detection is crucial for the completeness and consistency of inventories.

Build resilience against the unknown

Cyber resilience is a company's ability to adapt and evolve its security posture to stay one step ahead of the next security threat. To be prepared, security experts must ensure that their software ecosystem is well-equipped for effective response and resilience, minimizing the time from identification to resolution of the issue. By acting proactively through transparency, governance, and continuous deployment, companies are better prepared for the next supply chain attack.

About the author: Josh Lemos is CISO and thus responsible for information security at GitLab.