How Detecting High Priority Malware will Accelerate Quality App Development and Release

When it comes to malware's persistent threat to your business, we typically discuss risk in context to failed compliance with regulations, or we talk about data loss, or we focus on fears around business continuity. But internal application quality and the software supply chain are often left out of the conversation — likely because the risk remains somewhat ambiguous. Today, it's time to talk about application quality and release, how malware might impact that system and those processes just as much as it impacts any others, and how you can make improvements.

Today's Malware Risks

The malware risks to supply chain assets is intense and real; attacks have been seen in the wild at scale. Your developer, build and test, and production environments all feature nuances that allow 1) new malware to enter, 2) existing detection to fail, and 3) the software development lifecycle to be compromised. For instance, your build and test environment can be exposed to insider contamination, developed with malicious third-party software components (code, certificates), and lack post-build package and certificate verification — all possible vectors of attack.

Your production environment presents more risks.

For example, Operation ShadowHammer, a supply chain attack that leveraged ASUS Live Update software, was able to remain undetected due to the fact that the updates were signed with legitimate certificates. Vendor updates and package redistribution can present further avenues for malware to infiltrate and remain undetected.

Other real-world malware risks include your use of open-source components for software development. Sometimes, attackers will make concerted attacks against your supply chain to substitute a tool you believe you need with something malicious. Sometimes, it's as simple as typosquatting, and you end up not with the SQL driver you thought you were going to get, but a bitcoin miner instead based on a mistake

Room for risk leaves room for consequence. So how do you include the right kinds of controls in your software development life cycle (SDLC) — the kind that ensure your applications aren't acting as vectors of attack?

Today's Mitigation

The traditional tools for dealing with any of these malware risks through continuous integration (CI) are not the most powerful in terms of threat detection. Most enterprises run vulnerability scans and antivirus software, but in many cases, new vulnerabilities and malware won't be incorporated into CVE and blacklist databases.