November 2023 Summaries

Cloudsmith has secured $11M in additional funding, following its $15M Series A two years ago, to support its growth strategy and compete with established players like JFrog and Sonatype in the market for enterprise-class artifact management platforms. The company aims to dominate these market takeovers by offering a comprehensive feature set and amplifying its presence through bold sales and marketing efforts. Cloudsmith plans to scale up significantly in critical areas, including engineering, marketing, customer success, and global expansion, with the goal of simplifying software developers' lives and making their work more productive and enjoyable.

To secure your software supply chain, organizations should adopt Level 1 of the Secure Supply Chain Consumption Framework (S2C2F), which focuses on ingestion, inventory management, and scanning. This involves using an artifact repository like Cloudsmith to cache OSS packages, maintaining an automated inventory of all OSS used in development, and scanning for known vulnerabilities and licenses. By implementing these steps, organizations can bolster their software supply chain's resilience against potential threats and ensure the availability of OSS package dependencies. Leveraging package managers and automated inventory tools enhances security and guarantees availability when consuming OSS, making it easier to identify and address vulnerabilities and license issues.

The use of open source software has become widespread in modern C++ development, with package managers playing a crucial role in managing dependencies and ensuring compatibility across projects. However, despite the growing adoption of package managers, there is still considerable progress needed to outpace traditional approaches like copying and pasting code or downloading prebuilt binaries. The benefits of a package manager include efficient dependency tracking, version control, automated security auditing, and enhanced collaboration. Two popular C++ package managers are Conan and vcpkg, which offer an active community, healthy package registries, and simplify the process of managing, consuming, and distributing libraries.

The Secure Supply Chain Consumption Framework (S2C2F) is a practical guide to securing the consumption of Open Source Software (OSS), providing eight core principles and four maturity levels to help organizations improve their security posture when using OSS. The framework emphasizes the importance of knowing your OSS, preventing vulnerable package introductions, and maintaining robust patch management. S2C2F can effectively counter various real-world attacks targeting OSS, including known vulnerabilities, maintainers-based threats, public upstream-based threats, and others. Cloudsmith, a platform that aligns with S2C2F principles, can help organizations implement the framework by providing features such as artifact repository management, package scanning, policy management, and more. By following S2C2F and utilizing Cloudsmith's tools, organizations can elevate their security posture and mitigate against OSS-related attacks.