How to Secure your Software Supply Chain

Jul 07, 2021 · 9 min read

security

Introduction

A supply chain is a series of operations necessary for product supply. It includes each stage of the product’s lifecycle, from idea to customer. It covers distributors, producers, and retailers involved in developing and distributing the final product.

Thus, a traditional supply chain begins with the necessary raw materials and makes its way to the suppliers of those products through procurement. Then these suppliers supply the materials to the producers. After the production, it proceeds to the chain’s following link: distribution. The distribution includes storage, transport, and retailers – the last link in the supply chain connects the goods to the customer.

Meanwhile, the software supply chain follows almost the same pattern. Everything begins with planning. In a typical supply chain, planning involves ensuring that the appropriate quantity of raw material is obtained from suppliers to meet demand.

We use open-source code in all of our projects in today’s world. It is irrelevant whether you use open source or not for business purposes - the volume matters. Suppose you are unaware of the components that make up your software supply chain. In that case, a vulnerability is one of your dependencies that might harm your software, leaving it open to possible cyberattacks. This article will briefly examine what a software supply chain is, what supply chain risks exist, and how to minimize them.

Before we look into details of the software supply chain, we take into consideration the risk of the software supply chain.

Packagecloud will scan and validate all of the packages in your repository for vulnerabilities. Packagecloud detects vulnerabilities, poisonings, and trojan-horse threats and verifies the integrity of the packages you use. Additionally, Packagecloud checks your packages guaranteeing that nothing included inside them is vulnerable.

Packagecloud can store all of your packages in one location, giving you complete control over the packages you use. Rather than relying on public repositories, you can maintain safety by always using packages from your controlled environment.

Attacks in Software Supply chain

A software supply chain attack occurs when hackers modify the script of third-party software applications to undermine the programs that rely on them.

A software supply chain attack happens when a malicious script is intentionally inserted into a component and then distributed to its targets through its supply chain. Supply chain threats are a genuine possibility. There are various ways to attack a supply chain, ranging from directly introducing harmful code as a new committer, to compromising a committer account, to distributing software that isn’t formally part of a component.

However, a cyberattack on the software supply chain is seldom the final aim in and of itself. Instead of that, it’s a chance to inject malware for crypto mining or a backdoor for network access.

Attacks on the software supply chain remain uncommon, with less than tens of breaches each year. Additionally, they are often highly focused - for example, nation-states assaulting energy sector corporations. Hence, they are not a universally relevant threat. As of yet, large-scale assaults on open source security have been rare, but as awareness improves so does the number of people giving it a shot.

Through lateral movement, attackers use stolen software to steal data, damage targeted systems, or gain access to other portions of the victim’s network.

Software vs. Hardware Supply chain Attacks

Hardware makers outsource specific components to various firms, whether it’s routers, servers, IoT devices, or mobile phones. Unfortunately, like software developers, they typically have little insight into the security issues that the hardware involves.

According to Microsoft, tampering with hardware and firmware is more complicated than with software. It takes either detecting devices or their components on their way to the manufacturer or modifying them on the factory floor. However, the effects may be severe.

Once implemented, malicious alterations are “complex to identify and repair,” according to Microsoft. This kind of tampered hardware is deeply effective because “it bypasses typical software-based security detection techniques.”

Why is it essential to have a secure software supply chain?

Software dependencies are common nowadays. It’s usual for your projects to rely on hundreds of open source dependencies—on average, 203 per repository—that you didn’t create yourself. According to industry statistics, 99 percent of applications include open source code, while between 85 and 97 percent of business codebases include open-source code. It signifies that the majority of your application is composed of code that you did not write. Vulnerabilities in third-party or open-source dependencies, which you probably cannot manage as closely as your code, offer substantial security risks.

If one of these dependencies has a loophole, it is likely that you do as well. What’s worrying is that a dependent may change without you realizing it. Modifications within or outside of your code may expose you in the future. By leveraging the effort of thousands of open source developers, you essentially provide the thousands of strangers who contribute to the open source code an opportunity to have a say in what is ultimately in your production code.

As a result, an unpatched vulnerability, an accidental error, or a deliberate attack on a supply chain dependency might have a profound effect on you.

Methods to secure your software supply chain

We can protect against software supply chain threats – including those that cause dependency confusion. The following section contains a list of critical software supply chain security best practices that will allow you and your team to minimize risk and minimize your attack surface.

Defending against attacks of dependency confusion

As predicted, the dependency confusion assault resulted in clone attempts against other businesses’ software supply chains. The following are some precautions to take to secure your protection:

Use a scoped namespace - npmjs, one of the attack’s sensitive ecosystems, supports package scopes. The usage of so-called “scoped packages” restricts the package’s namespace and associates it with a particular user/organization. This minimizes the dependency confusion threat since no basic package is substituted for the user’s original purpose, and an alternative upstream repository is used.
Use repo-specific settings for clear upstream registry definition - when given explicit instructions, certain package managers, such as pip and npm, attempt to address package information look-ups. This leads to these clients searching public registries such as npmjs and PyPI for updated versions of a package, which leads to the intended package being replaced with a malicious one.

Prevent open-source packages from executing unauthorized installation instructions

Certain package managers, such as npm, allow any installed or removed program to run arbitrary instructions. Several malware packages, such as getcookies, have already exploited this entry point by inserting a backdoor enabling code injection into a running Node.js application server while appearing as an Express application middleware. Another attack vector is via a typosquatting attack. A victim installs a malicious package through a dependency tree or inputting the incorrect package name on the command line. Unsurprisingly, there is so much dependency confusion that hundreds of typosquatting attacks have been launched against npmjs, PyPI, and RubyGems, among other language ecosystems. Thus, avoid installing packages naively or by careless copy-paste without first evaluating the package.

Use packagecloud to verify packages

You can also make use of package managers that focus on security, such as packagecloud. Packagecloud can secure all of your packages, independent of their language, operating system, or other attributes. Packagecloud protects npm, .deb, and ruby, among other technologies. While competitors concentrate only on hosting packages for a single language/OS, we can provide greater value to our clients by hosting everything they need in one location. As well, packagecloud focuses on security and auditing packages to make sure that all packages meet security requirements.

Ensure that multifactor authentication is enabled across your software supply chain

As users, providers, or maintainers, we are all members of the open-source community. We are more reliant on one another than ever before, and verification is becoming more critical to guarantee that people can trust us and the products we manage.

We can use the percentage of developers that activated 2FA on npmjs to check how far we’ve come as a developer community regarding password health and preventing account takeover attempts.

We strongly advise and encourage you to strengthen security measures across all registries and ecosystems, including npmjs, RubyGems, .deb, Docker, and GitHub, and enable multi-factor authentication.

Prevent the disclosure of confidential information

As open-source software use increases, it is becoming more common to work and connect with others in the open. That raises the possibility of accidentally releasing or revealing sensitive information, which is then released publicly.

Conclusion

To summarise, a software supply chain consists of everything that enters or impacts your code.

While supply chain hacks are real and increasing in popularity - the most critical thing you can do to safeguard your supply chain is identify your vulnerabilities. Then, to adequately protect your software supply chain, you must understand your environment’s dependencies, be aware of their vulnerabilities, and swiftly fix them.

To secure your supply chain software, you can make use of packagecloud.

Packagecloud verifies and audits packages to prevent supply chain poisonings, trojan-horse attacks, and package confusion attacks. Additionally, packagecloud evaluates your packages against all known cybersecurity risks, guaranteeing that nothing inside them is vulnerable.

Packagecloud can store all of your packages in one location, giving you complete control over the packages you use. Instead of utilizing public repositories, you may simply ensure that packages are always pulled from a controlled environment.

Use packagecloud to ensure the security of your packages and software supply chain. You should register for a free trial of Packagecloud, and get started in minutes.