Leverage third-party software validation to bolster your supply chain security

Most security teams will point to the software supply chain as one of their most intense cyber risks. The most commonly cited problem is that software from external suppliers and partners can contain malware or could support unwanted types of behavior that would allow an attacker to compromise enterprise resources or data.  

To deal with this risk, enterprise teams must find a way to address the integrity of the software being used, either as components of internally managed systems or embedded in some externally managed platform or system. This is not an easy task, and typically requires partnership with a capable commercial vendor. 

In this post, discover how risk is emerging with third-party software, and how third-party software security validation is key to mitigating that risk. Learn why partner solutions that offer effective functional support in the mitigation of software supply chain attacks are key.

Key takeaways: Supply chain security risks addressed in new Gartner reportGet the Gartner report: Mitigate Enterprise Software Supply Chain Security Risks

Third-party software risk 

The cyber risks that emerge in the context of third-party software are no longer a point of debate in the security community. Rather, the typical discussion is more along the lines of how to locally prioritize these risks in the context of the organizational mission. The most common risks from third-party software include the following:  

• Exploitable vulnerabilities – The potential arises that third-party software can be configured in a manner that is exploitable by malicious intruders.  
• Software containing malware – The possibility emerges that software from third parties might include malware inserted during the development or delivery process. 
• Data leakage – There is the possibility that third-party software will not sufficiently protect enterprise data, resulting in leakage that could have high consequence. 

The implication here is that dependence on third parties for software introduces risk that must be addressed in some manner. External validation of third-party software is one of the more promising methods of risk reduction. Here's how this typically works in the context of a partnership with a capable commercial vendor. 

Third-party software validation 

To deal with third-party software risk, enterprise teams should select a commercial vendor partner that can perform validation on all software of interest. As suggested above, the ReversingLabs platform offers effective support in this area and will serve to define suitable functional requirements.  

Specifically, we recommend that third-party validation include the following functional security capabilities: 

• Supply chain analysis – This involves support for end-to-end analysis of supply chain components in the form of workflows and release packages. 
• Threat database – This is an essential resource of malware driven by advanced threat intelligence processes and automation. 
• Deep file scan – This involves the analysis of files in search of malware, regardless of the size of the file or location (e.g., cloud). 
• Dynamic file assessment – This involves assessment of files as they traverse the infrastructure as email attachments, on endpoints, and so on.
• Threat analysis – This involves support for the threat hunter to enable dynamic analysis of files and binaries in search of evidence that malware might be present. 

Learn how the ReversingLabs team can assist buyers with any questions about how these functions work together on the platform. TAG Cyber analysts are also always available to provide guidance on how this and similar platforms can be used to reduce the cyber risks associated with third-party software. 

Copyright © 2023 TAG Cyber LLC. This report may not be reproduced, distributed, or shared without TAG Cyber’s written permission. The material in this report comprises the opinions of the TAG Cyber analysts and is not to be interpreted as consisting of factual assertions. All warranties regarding this report’s correctness, usefulness, accuracy, or completeness are disclaimed herein.

RELATED: TAG CYBER SERIES

• Chris Wilder: Modernize your SOC with advanced malware analysis, real supply chain security — and best practices
• David Neuman: Integrate threat hunting into the SOC triage process to mitigate software supply chain risk
• John Masserini: Software supply chain security and SBOM automation: The next big step in risk management
  
• Chris Wilder: Shift the SOC left: Why your organization should integrate DevOps with Security Operations