July 2022 Summaries

In recent discussions with numerous CISOs, the varied interpretations of "software supply chain security" have become evident, with a shared concern about the heavy reliance on open source software and the lack of governance surrounding it. Open source software, which constitutes over 70% of modern applications, presents a significant security risk due to its indirect dependencies, which are often untracked and unmanaged. Despite the benefits of open source in enhancing development speed, the increasing software supply chain attacks and incidents like Log4j highlight the vulnerabilities and the operational challenges in managing them. While commercial software is subject to rigorous security assessments and compliance checks, open source software is often implicitly trusted without similar scrutiny, leading to security gaps. The concept of Zero Trust, which emphasizes continuous verification, is proposed as a solution to manage dependencies more securely, advocating for comprehensive visibility, risk measurement, and prioritized maintenance to protect against supply chain risks. This approach aims to balance the power of open source with the need for robust security practices to ensure its continued use and innovation within enterprises.

The Cyber Safety Review Board's report on the Log4j vulnerability, CVE-2021-44228, reveals that the operational overhead of addressing such vulnerabilities can be as damaging as the vulnerabilities themselves. The report highlights the challenges faced by organizations in identifying and mitigating the risks associated with Log4j due to complex dependency graphs in modern software, where much of the code is indirectly pulled from open-source packages. The global response, while generally swift, was hindered by the lack of authoritative sources for exploitation trends and the absence of scalable solutions for vulnerability management. The report emphasizes the need for improved automation, contextually aware vulnerability management, and better software bill of materials (SBOM) practices to enhance risk management. It also discusses the potential long-term impact on cybersecurity talent due to the intense pressure of responding to such incidents. Endor Labs aims to address these challenges by providing tools for better visibility into dependency usage and risk management decisions, advocating for a more informed approach to open source software adoption and maintenance. The report concludes that the cybersecurity industry needs to mature further to manage national security and risk more cost-effectively.

Security teams have traditionally been involved late in the software development lifecycle, often being perceived as obstacles, but the industry is shifting towards integrating security earlier in the process through the "shift left" movement. This integration requires security teams to model threats both to applications and their delivery methods, aiding in more informed risk management. Mature software development practices, shaped by comprehensive failure analysis, emphasize sustainability, trust, and quality as the three operational pillars. A significant challenge is managing the sustainability of software, given that 70% of standard application code is open source, with many projects relying on unmaintained components, which introduces risks. Trustworthy software is bolstered through adherence to standards like Supply Chain Levels for Software Artifacts (SLSA), addressing source, build, and availability threats with practices such as multi-factor authentication and branch protection rules. Quality is maintained through automated testing, static security testing, and software composition analysis to ensure software is secure, useful, and generally free of significant bugs. By focusing on these three pillars, mature organizations build resilient software, enhancing their ability to manage potential failures effectively.

Endor Labs opted for a monorepo architecture over polyrepo primarily due to its advantages in centralized dependency management, which enhances development speed and reduces risks. In a monorepo, all code and libraries are stored in a single repository, allowing for a unified software bill of materials (SBOM) and providing a clear overview of dependencies and their versions, which is more efficient than managing separate repositories as in a polyrepo setup. Monorepo architecture facilitates easier dependency ownership and makes updates more scalable, as changes to dependencies are centralized and immediately affect all projects. However, this can also mean that a regression in a dependency might impact the entire codebase, whereas polyrepos, by decentralizing repositories, isolate these effects. Despite the challenges of ensuring that updates don't negatively affect all projects, Endor Labs believes that with the right tools, a monorepo can increase development velocity and streamline dependency updates, aligning with their engineering culture and product delivery goals.