September 2022 Summaries

The concept of software supply chain security has become increasingly important in the rapidly changing development ecosystem over the past five years. With remote work becoming widespread due to the pandemic, companies have had to adapt their security measures to control access from outside sources. Developers and their environments are part of the software supply chain, making them potential entry points for malicious code or credential theft. A zero trust approach can help secure development environments more effectively by enforcing explicit permissions over implicit ones and following the principle of least privilege. This involves verifying users every time they try to access a resource and granting minimal permissions necessary for their tasks, while continuously checking these permissions. Key components of this approach include endpoint security, Software Bill of Materials (SBOM), access management, anomaly detection, and misconfigurations scanning.

The Enduring Security Framework (ESF) published a guidance document for securing the software supply chain in late August. While it emphasizes application security activities, it lacks practical software supply chain security guidance. The ESF's recommendations are advisory and not legally binding. The document focuses on having an application security program but offers rigid guidance for Software Development Lifecycle (SDLC) elements. It also overlooks several important software supply chain security activities such as anomalous developer behavior detection, scanning for hardcoded secrets, and minimal access to code maintenance. The ESF's solutions are considered outdated and inefficient compared to advanced frictionless solutions being developed by companies like Arnica.