April 2022 Summaries

Cloudsmith is a cloud-native package management tool designed to help banks and financial institutions manage their software supply chain securely. It provides universal, multi-format repositories that support various package formats such as Maven, NuGet, Go, Scala, Rust, Docker, Helm, R, Lua, Conda, and raw file formats. The tool blends package management and software supply chain management, storing all software artifacts, dependencies, and metadata in one place. Cloudsmith aims to establish trust and provenance in the software supply chain by surfacing package metadata, including checksums, build information, and dependencies. It also provides automation features through Continuous Packaging (CP) techniques, integrates with CI/CD tools, and supports secure developer-focused tooling such as Cosign and SBOMs. The tool is designed to help banks and financial institutions attract engineers, reduce costs, and improve efficiency by providing a simple solution to secure development artifacts.

With the increased focus on software supply chain security, organizations are reevaluating their Continuous Integration and Continuous Deployment (CI/CD) processes to identify vulnerabilities and implement measures to secure build and deployment pipelines. The 2022 DevOps Institute SKILup Day featured an introduction to Continuous Packaging by Dan McKinney, Developer Relations at Cloudsmith, which discussed the importance of securing build and deployment pipelines in today's software supply chain landscape. Key takeaways from the talk included understanding the risks associated with unsecured CI/CD processes and learning strategies for implementing secure packaging and validation techniques.

Software programs today can be likened to complex stews with multiple ingredients sourced from disparate places. Open-source tools are a major ingredient, comprising 70% of code overall, according to the 2020 Open Source Security and Risk Analysis report. DevSecOps teams must maintain and monitor third-party components that make up modern software, using a software bill of materials (SBOM) to help with this work. The concept of SBOMs has recently come into prominence due to events such as attacks on companies' software supply chains, the Solarwinds hack, and the May 2021 U.S. Presidential Executive Order on Improving the Nation's Cybersecurity, which requires software vendors to provide SBOMs to the U.S. federal government. An SBOM is a list of all components and dependencies in a piece of software, including open source and proprietary software, and should explicitly state if there are any missing elements to the inventory. The minimum required elements of an SBOM include data fields, automation support, practices and processes, and standards for delivery. Any organization that produces, purchases, or operates software will benefit from an SBOM, which can help with regulatory compliance, merger and acquisition due diligence, vulnerability remediation, and generating customer loyalty. Misconceptions about SBOMs are common, but they do not require public exposure and are primarily a defensive document to counter attacks and correct vulnerabilities quickly. The use of SBOMs has additional benefits, including reducing the chance of supply chain attacks, generating customer loyalty, and reducing operational costs.