March 2024 Summaries

On March 14, 2024, CISA issued the Secure Software Development Attestation Form to ensure software suppliers adhere to secure development practices as outlined in Executive Order 14028 and the NIST Secure Software Development Framework (SSDF), with deadlines for critical software by June 8, 2024, and all other applicable software by September 8, 2024. The form applies to newly developed software, existing software with major updates, and continuously updated SaaS, excluding federal-developed software, open-source software, and freely available software without a supplier relationship. It requires software suppliers to describe their software and provide information about the producer, with the option to submit a third-party assessment from a FedRAMP-certified organization. Suppliers can attest company-wide or for specific products, with the form emphasizing secure environments, trusted source code supply chains, code and artifact provenance, and ongoing vulnerability scanning and remediation. Endor Labs offers tools to support compliance across these dimensions, including repository security management, OSS governance, secret detection, CI/CD discovery, and artifact signing, enhancing software supply chain security and transparency.

In 2023, there has been a notable increase in the adoption of DevOps practices, including CI/CD automation pipelines, which enhance productivity and organizational efficiency. Despite their benefits, these pipelines present challenges for security teams, particularly due to "shadow engineering," where developers use unsanctioned tools and processes. This can complicate compliance and risk management, as seen in incidents like the SolarWinds compromise. To address these issues, organizations are encouraged to implement responsive security controls rather than relying solely on preventive measures, which can hinder developer productivity. Endor Labs offers solutions to efficiently monitor and manage CI/CD pipelines, providing tools for discovery, reporting, and risk management to ensure compliance and security without imposing significant productivity costs on developers.

Updating open source software (OSS) dependencies, often recommended as a best practice for vulnerability management, is fraught with challenges that extend beyond technical considerations to include operational, security, and compliance issues. Research highlights the instability and compatibility risks that updates can introduce, with studies showing that test coverage in projects is often insufficient to catch issues caused by dependency changes. Moreover, while Semantic Versioning (SemVer) aims to minimize the risk of breaking changes, its effectiveness is undermined by inconsistent application, as shown in studies like those examining Maven Central projects. The potential for introducing malware when updating dependencies and the chance of overlooking licensing changes further complicate the process. The opportunity cost of upgrades, which diverts developers from value-adding activities, must also be weighed. Effective dependency management strategies recommended include thorough regression testing, treating third-party libraries as internal code by writing tests for them, and evaluating the size and dependencies of libraries relative to their utility. A risk-based approach, such as reachability-based software composition analysis (SCA), can help prioritize necessary updates without overwhelming developers with unnecessary tasks.

In an on-demand webinar hosted by Endor Labs and featuring Staff Research Engineer Darren Meyer, the focus is on using reachability analysis to prioritize Software Composition Analysis (SCA) findings and significantly reduce unnecessary noise. The session begins with a technical overview of dependency management and highlights a successful case study where a client experienced a remarkable 93.56% reduction in alerts. Key topics covered include identifying vulnerable sections of open-source software packages, prioritizing SCA results based on program analysis, and enhancing tools like Dependabot with Endor Labs' solutions. The webinar concludes with a Q&A session, offering insights into the integration of Software Bill of Materials (SBOM) support within SCA tools.

Endor Labs CI/CD provides a comprehensive solution for enhancing security, traceability, and compliance in software development by implementing strong cryptographic artifact signing. This system extends beyond traditional code signing to include all artifacts—such as containers, configuration files, and media assets—ensuring only trusted and verified components are deployed. By integrating artifact signing with Endor Labs, organizations can establish provenance and prevent unauthorized deployments, thereby mitigating risks associated with vulnerabilities and malicious activities. The platform supports code-to-cloud and cloud-to-code traceability, allowing rapid identification and response to security incidents by linking production artifacts to their source repositories. Unlike open systems like Sigstore, Endor Labs offers a private and seamless approach, leveraging existing SSO identities and requiring minimal infrastructure changes. This enhances operational security without exposing sensitive metadata, while also providing additional features like CI/CD discovery and repository security posture management to further bolster an organization's software supply chain security.