“We calculated a supply chain interconnection influence in 15% of the breaches we saw…For a breach to be a part of the supply chain interconnection metric, it will have taken place because either a business partner was the vector of entry for the breach…or if the data compromise happened in a third-party data processor or custodian site…Less frequently found in our dataset, but also included, are physical breaches in a partner company facility or even partner vehicles hijacked to gain entry to an organization’s facilities.”
Verizon 2024 DBIR
Over the years, I've had the privilege of supporting numerous leadership teams across major brands in cybersecurity, technology, audit, and business sectors. My work has involved organizing, enabling, and enhancing security outcomes related to business applications, ODM/OEM products, and startup solutions. Throughout this journey, I've observed significant variations in how enterprise organizations structure their cybersecurity, software development, technology operations, and how these capabilities support business objectives. Despite these differences, one common challenge stands out: effectively integrating security into software development practices.
Operating a security lifecycle for products and applications is not an easy task. Many organizations are unaware of just how deeply security can and should be embedded in their business software development practices. As a result, many are not doing enough to secure their product and application lifecycles. What constitutes “enough” varies depending on several factors, including the type of product (IoT, web application, car, phone, etc.), organizational structure, and the ability to integrate and accelerate security checks throughout the development process.
A fully-integrated DevSecOps approach can stabilize developed products by embedding security into every stage of the development process. However, this integration is often limited to specific applications or products that follow the DevSecOps cadence. Products outside of this scope are left vulnerable, relying on the best efforts of the development teams. The importance of this issue becomes glaringly apparent when considering the numerous software breaches over the years, such as the Apache Struts 2 Framework at Equifax.
In all instances, it's crucial to ask the right strategic questions to determine if your organization is well-structured for effective security integration:
Securing your application and corporate supply chain is so critical that entirely new standards have been created, such as Software Bill of Materials (SBOM) requirements. These efforts aim to expose sub-components in software that may impact the security of purchased or open-source software. All this is due to the increasing complexity and interconnectedness of modern technology and software development. Application supply chain includes all components, such as code, libraries, and tools, that contribute to the final product. With the widespread use of third-party and open-source software, third party connections, and more, vulnerabilities can arise in any part of the supply chain, ultimately compromising the entire solution or application. For more information on government defined guidance, see this link from CISA.
There are plenty of conditions and examples, but we wanted to include some of the typical factors driving these vulnerabilities:
Strengthening security measures to discover, verify, and prevent vulnerabilities is essential for mitigating risks. This includes secure coding practices, threat assessments, secure code and release gates, image security, Infrastructure as Code (IaC) security, continuous monitoring, vulnerability management, and runtime monitoring. Implementing these practices increases security capabilities and enables strong governance decisions.
Integrating security feedback loops throughout development practices offers several benefits:
A comprehensive supply chain security plan can focus on risk management, data protection, Cyber Defense, compliance, or incident response. DevOps and DevSecOps organizations can protect their supply chains from disruptions and cyber threats. These ultimately create awareness and visibility for other organizational groups to support enhanced decision making.
From a combination of strategic planning, continuous monitoring, and collaboration with all stakeholders, we’ve created a short list of actions you can take to get an operating baseline to grow with. Here are some actionable steps you can take:
By implementing these best practices, you can significantly enhance the security of your supply chain.
The leading practice frameworks you should consider if you are just starting to plan for this is BSIMM (Building Security In Maturity Model) or OpenSAMM (Software Assurance Maturity Model). Both are valuable frameworks for improving software security, and both frameworks provide a benchmark and guide consistent security practices and create strategic and technical value.
The difference between BSIMM and OpenSAMM is primarily how they were created. One was from a consortium of practitioners who wanted to provide leading approach to ensure everyone could have access to a framework to secure development. BSIMM was more of a response to large organizations needing to be better at software development. In both scenarios, the goal is the same which is to incorporate consistency and stability with security practices embedded in software development. Biggest difference is OpenSAMM is free to use and BSIMM is not so much.
The main intent is to establish governance, intelligence, security in software development lifecycle, and improving environments. One of the main high-level objectives in both framework is to create the ability to observe and report security and weaknesses in software development practices so that steps can be productive and valuable to improving the posture of their secure software.
Securing the software development lifecycle, particularly within the context of modern, interconnected supply chains, is a critical and complex challenge. It requires not only a strategic approach but also a commitment to embedding security deeply into every phase of development and deployment. By leveraging frameworks like OpenSAMM and BSIMM, organizations can establish robust security practices that align with their unique operational needs and regulatory requirements. The integration of security into the DevSecOps process, continuous monitoring, and a well-defined incident response plan are not just best practices but essential components for maintaining the integrity and trustworthiness of business-critical applications.
Ultimately, the goal is to ensure that security is not an afterthought but a fundamental part of the development process. By addressing vulnerabilities proactively and maintaining a vigilant stance on supply chain security, organizations can better protect themselves from the ever-evolving landscape of cyber threats. The benefits of these efforts are far-reaching, from safeguarding sensitive data and intellectual property to maintaining customer trust and avoiding costly breaches. As technology continues to evolve, so too must our approaches to securing it, ensuring that our development practices are resilient, forward-thinking, and capable of supporting the long-term success of our organizations.