Spectra Assure Free Trial
Get your 14-day free trial of Spectra Assure for Software Supply Chain Security
Get Free TrialMore about Spectra Assure Free Trial
With major software supply chain attacks including the SunBurst attack on SolarWinds in 2020 and the critical vulnerability Log4j, software security moved front and center for risk managers and software teams alike. These incidents, along with a string of other attacks that span the past few decades, show the problem is only getting worse as bad actors target an increasingly complex process for building software — and the software development toolchain itself.
The problem has accelerated dramatically in the past three years, with software supply chain threats via open-source repositories skyrocketing by 1300% between 2020 and 2023, catching security teams off guard. Also: Nearly nine out of 10 security and IT professionals surveyed in a 2023 study said that their companies detected security issues in their software supply chains in the last 12 months.
The problem of software supply chain security has also caught the attention of the U.S. federal government, which has been very active over the past few years in seeking to tackle the problem head on. Those efforts include the White House's Executive Order on Improving the Nation’s Cybersecurity, released in May 2021, and a flurry of other critical initiatives and guidance that have followed, including the Secure by Design initiative in 2023.
Here is a definitive timeline of the U.S.'s major software supply chain policy initiatives and mandates:
Special Report: The State of Software Supply Chain Security (SSCS) 2024Download Report: State of SSCS
The White House released an Executive Order (EO) on Improving the Nation’s Cybersecurity (14028). The EO aims to improve several areas of cybersecurity, including software supply chain security.
The Secretary of Commerce, in coordination with National Telecommunications and Information Administration (NTIA), released Section 4 f of EO 14028, which lists the minimum elements required for a software bill of materials (SBOM).
(Read more)
The NTIA introduced the Vulnerability Exploitability eXchange (VEX), which was created to “fill a particular need regarding use of software bills of materials."
(Read more)
The National Institute of Standards and Technology (NIST) released the first version of the Secure Software Development Framework (SSDF).
(Read more)
The federal government’s Enduring Security Framework (ESF) working panel released the “Securing the Software Supply Chain” report, meant to be a practical guide for developers.
(Read more)
The White House's Office of Management and Budget (OMB) issued memorandum (M-22-18), which mandates all federal agencies to attain attestation of software security from any software company doing business with the federal government, as described in NIST’s SSDF guidance.
(Read more)
U.S. Senators Peter and Portman introduced Senate Bill S. 4913, which aims to establish the duties of the Director of CISA in relation to open source software security.
(Read more)
The federal government’s ESF working panel released the second series of the “Securing the Software Supply Chain” report, meant to be a practical guide for software suppliers.
(Read more)
The federal government’s ESF working panel released the third series of the “Securing the Software Supply Chain” report, meant to be a practical guide for customers.
(Read more)
The White House released the National Cybersecurity Strategy, which comprises five pillar areas that address the federal government’s goals to improve the nation’s cybersecurity.
The Cybersecurity and Infrastructure Security Agency (CISA), along with 17 other U.S. and international partners, released Secure by Design, an initiative that aims to shift the burden of software risk from consumers (buyers) to the producers of the software (development companies.)
(Read more)
CISA and the National Security Agency (NSA) released a Cybersecurity Information Sheet (CSI) on Defending Continuous Integration/Continuous Delivery (CI/CD) Environments, which outlines recommendations and best practices for improving defenses in the software development, security, and operations (DevSecOps) process.
(Read more)
The Securities and Exchange Commission (SEC) released a set of rules on “Cybersecurity Risk Management, Strategy, Governance, and Incident Disclosure.” As of August 2023, SEC registrants will now have to disclose material cybersecurity incidents, and annually disclose “basic material information” about the company’s state of cybersecurity.
(Read more)
The Food and Drug Administration (FDA) released “Cybersecurity in Medical Devices: Quality System Consideration and Content of Premarket Submissions” as a reference document for device manufacturers, who must now report on their medical devices’ cybersecurity, in accordance with part (f) of Sec. 524B in H.R.2617.
(Read more)
CISA released guidelines for a “Software Identification Ecosystem,” with the goal of it being both a precise and generic resource that supports software “grouping.”
(Read more)
As a part of its second phase of the “Securing the Software Supply Chain” guide, the ESF working panel released “Securing the Software Supply Chain: Recommended Practices for Software Bill of Materials Consumption,” which is meant for developers, suppliers, and customers.
(Read more)
While prompt injection and data disclosure remain concerns, excessive agency climbed the list — not surprising with recent security incidents.
The post-mortems of two compromises by rogue AI agents show that security teams need to focus on guardrails, not the AI model.
