In 1998, I testified before the Senate about the lack of understanding software vendors like Microsoft had about the vulnerabilities in their code — and how those mistakes could be leveraged by attackers. More than two decades later, although a lot has changed, we are still essentially facing the same problems.
At Veracode, we recently discovered in our new “State of Software Security” report that 83% of applications have at least one flaw, and there’s a long and growing tail of flaws that are identified but not remediated.
Today, software is in everything, and third-party software is part of every development environment. The people architecting the next generation of cloud applications are building them with large numbers of microservices, open source components and APIs.
While many enterprises have developed robust testing processes for internal software applications, those programs typically don’t include security scanning on third-party and open source software. This testing is often presumed to be secure or is overlooked in application security testing, which leaves a wide-open gap in an organization’s security strategy.
This is part of the reason why the software supply chain can represent tons of risk and leave organizations exposed. Every single business has this problem, and it’s getting worse over time because everything keeps getting more fragmented, more distributed and faster.
How Much Risk Are We Talking About?
Major breaches can occur from vulnerabilities in the smallest of programs. Third-party software used in nonmission-critical applications may not be properly checked for vulnerabilities. So, just how much risk from backdoor breaches and advanced threats targeting the application layer are we talking about? For many companies with large networks of vendors, the risk is much bigger and more serious than they realize.
To share an example, one of our clients (a global industrial manufacturing company) conducted an ad hoc audit of its third-party software and found more than 90% of its purchased applications had critical security vulnerabilities. In response, the company used an application security solution to get the problem under control, and after working with 100 of its vendors over one year, it fixed more than 10,000 vulnerabilities.
Five Ways To Secure Your Software Supply Chain
Modern development life cycle is like spaghetti: it is complex, interwoven and never follows a straight line. We can’t ignore the security behind all of that code. Risk permeates our supply chains at multiple levels, and when software is dependent upon the security of other software products, open source components and APIs, organizations must hold one another accountable for security of the software supply chain.
There is no easy solution, but there are several things businesses can all do to improve the security of the software supply chain:
1. Specify security expectations in contracts upfront: Consider the suggestions in this list as potential security requirements in your third-party vendor contracts. This could mean that you require proof of a third-party security assessment or detailed internal security processes to be run on the code behind each API. Make it contractual, and do it upfront.
2. Demand continuous assessment with the right level of transparency: To keep up with rapidly changing and deeply layered software supply chains, security scanning needs to be ongoing. There is readily available technology to automate the detection and remediation of security flaws. You can request that your third-party vendors provide security specifications alongside their APIs and that they are continuously maintained. Remember that software development is continuous, and software security testing needs to take place during all phases.
3. Talk to developers directly: Third-party software compliance is often done through checklists sent to the vendor, and the person filling out the checklist is likely in the sales department. Speaking directly with the people who created software can ensure that your questions and requests are fielded by someone who fully understands them.
4. Outsource some testing: Many other industries require independent audits and assessments related to product safety. Why should software be any different? It’s easy to assume third-party software was checked by their developers. But this testing process tends to be static over time, while the threat landscape is constantly changing. By outsourcing at least some testing to a professional InfoSec business, enterprises can ensure all applications are fully tested for vulnerabilities that could be exploited.
5. Utilize existing standards: When analyzing third-party software, it’s critical to have a basis for your testing. Standards like the OWASP Top 10 are a common way to check against the most frequent application vulnerabilities. Using components with known vulnerabilities or failing to update software can introduce significant security risks, as cybercriminals are constantly seeking vulnerable applications. Businesses should also monitor sources like Common Vulnerabilities and Exposures (CVE) and the National Vulnerability Database (NVD), but even these will not capture all of the known vulnerabilities that could be affecting your software.
Safer Software, Safer World
The need for physical security is obvious: You don’t want people to sneak into your building and tamper with your controls. But digital security, while less visible, is just as critical. Bad actors can sneak in through a digital network path and access those controls just as easily as if they’d slipped through an unlocked side door.
Are you background checking your software supply chain? This is especially important for service providers that have digital access to your controls — it’s as if they have a keycard to your private facility.
It’s going to take everyone — commercial software providers, enterprises, independent third-party assessors and security researchers — working together to create secure software and a safer world.
