Shoring Up Software Security: A CISO’s Guide to Tackling Supply Chain Risks

The Importance of Paying Down IT Security Debt

The Tradeoff Between New Features and Security

In the fast-paced world of IT, there has always been a delicate balance between shipping new features and addressing technical debt. Technical debt encompasses a range of considerations, including reliability, performance, testing, and security. Unfortunately, in the “ship fast and break things” era, many organizations willingly accumulate security debt as they prioritize the development of new features over essential security measures.

CISOs, or Chief Information Security Officers, play a critical role in recognizing the moments when security debts must be addressed. The recent Log4j exploit brought to light a significant accumulation of security gaps that were not even on the radar of most organizations. It exposed vulnerabilities in the relationship between open source projects and the developers, maintainers, package managers, and organizations that rely on them. A coherent plan is necessary to address these gaps and pay down the software supply chain security debt.

The Unique Vulnerabilities of the Software Supply Chain

Although companies have made significant strides in securing their networks, a new class of vulnerabilities has emerged related to the software supply chain. Traditionally, locking down network security has been a priority, but little attention has been given to the trust mechanisms and secure chain of custody within developer build systems and the software artifacts they use to create applications.

This lack of security in the software supply chain presents an opportunity for bad actors to exploit vulnerabilities and gain unauthorized access. These attackers can then pivot to other systems that depend on the insecure artifact they used to gain entry. The result is a widening attack surface and increased risk for organizations.

Locking Down Build Systems as a Starting Point

To address this growing security debt in the software supply chain, CISOs should advocate for the use of open source frameworks such as NIST’s Secure Software Development Framework (SSDF) and OpenSSF’s Supply Chain Levels for Software Artifacts (SLSA). These frameworks provide prescriptive steps for securing the supply chain.

Implementing SLSA Level 1 means using a build system, while Level 2 involves exporting logs and metadata for incident response. Level 3 requires following best practices, and Level 4 entails using a highly secure build system. By adopting these initial steps, CISOs can establish a strong foundation for a secure software supply chain.

Additionally, CISOs should consider implementing policies to guide developers’ acquisition of open source software. It is crucial for developers to understand their company’s security policies and ensure the integrity of the open-source software they acquire, which constitutes the majority of software used by developers nowadays. By locking down build systems and establishing repeatable methods to verify the provenance of software artifacts, CISOs can prevent the accumulation of further security debt.

Paying Down Existing Software Supply Chain Security Debt

After securing the foundation of the software supply chain, addressing old security debt becomes the next challenge. This debt includes updating software, patching vulnerabilities, and keeping base image versions up to date. While this process may be tedious and time-consuming, it is essential for overall cybersecurity.

Paying down this debt requires a close collaboration between CISOs and development teams. It also presents an opportunity to establish more secure and efficient tooling and processes within the organization’s software supply chain. However, some software teams may be resistant to updating their container base images, as doing so may lead to software application failures or compatibility issues. To mitigate this risk, software teams should adopt practices like frequent, incremental updates and “testing in production” techniques such as canary releases.

Additionally, using hardened and minimal container base images built with critical software supply chain security metadata, such as software bills of materials (SBOMs), provenance, and signatures, can streamline vulnerability management in base images. These measures strike a balance between maintaining security and ensuring uninterrupted production.

The Consequences of Postponing Security Debt

Postponing security debt can have severe consequences, often arising at the most vulnerable and least opportune moments. The Log4j vulnerability, for example, struck just before the busy holiday e-commerce season and significantly impacted engineering and security teams well into the following year. No CISO wants to face hidden security surprises lurking within their organization.

To minimize such risks, CISOs must invest in secure build systems, implement software signing methods to establish software provenance, and adopt hardened, minimal container base images that reduce the attack surface. By addressing security debt and continuously updating software and base images, organizations can achieve an acceptable level of vulnerability while maintaining their security posture.

Conclusion

As the IT landscape continues to evolve, organizations must strike a balance between shipping new features and prioritizing security. Accumulating security debt in favor of new features is a risky decision that can lead to vulnerabilities and security breaches. CISOs play a crucial role in recognizing when security debts must be addressed and putting together plans to pay them down effectively.

From securing the software supply chain to updating and patching vulnerabilities, organizations must adopt a proactive approach to mitigate risks. By partnering with development teams, implementing secure build systems, and establishing processes to verify the provenance of software artifacts, organizations can lay a strong foundation for a secure software supply chain.

Furthermore, organizations should prioritize the timely update of software and patching of vulnerabilities to avoid accumulating security debt. By collaborating with development teams and adopting secure tooling and practices, organizations can strike a balance between security and productivity.

Ultimately, organizations cannot afford to disregard security debt. The consequences of postponing security measures can be severe, as witnessed during the Log4j vulnerability. It is essential for organizations to take a proactive approach and invest in the necessary measures to maintain a secure IT ecosystem.

Editorial Note: Prioritizing security should be an essential aspect of any organization’s strategy. It is crucial to allocate resources and take proactive steps to address security debt rather than waiting for vulnerabilities to emerge. By doing so, organizations can protect against potential security breaches and safeguard their digital assets and reputation.