What Are Supply Chain Attacks? How to Protect Your Software Lifecycle

But that's not the kind of supply chain we're talking about here today. Instead, we're focusing on the software supply chain — an important new challenge to manage as businesses the world over undergo massive digital transformations. And yes, the software supply chain can have an impact on your traditional supply chain as more and more software is used to automate, monitor, and control many of the hard production processes.

What Are Supply Chain Attacks?

As more companies invest in digital initiatives and expand their IT infrastructure technologies and business processes, they also add software development and DevOps staff. And with the addition of software development life cycle (SDLC) practices to build and deploy applications, we’ve seen increasing use of open source software and dependencies on public packages to accelerate schedules.. Of course, stringent security measures should be in place to prevent poor selection of that code, but ultimately, open-source options abound, and engineers will use those options to create the applications required.

Hence, the emergence of the software supply chain attack: any attack that infiltrates your software life cycle. To counter these attacks, organizations must:

• Inspect before Build (e.g. read our blog on PyPI package malware in SupPy Chain Malware – Detecting malware in package manager repositories)
• Inspect before Ship
• Inspect before Deploy or Update (e.g. read our blog on ASUS Live Update attack in Forging the ShadowHammer)

Perhaps one of the most significant attack vectors is via the selection of code from public package manager repositories. In short, a supply chain attack is one in which the attacker isn't targeting your organization, specifically, but instead the code your organization will use.

This attack vector is primarily covert because the contributing person or vendor are assumed to be trusted entities. As more package manager repositories emerge, and more and more developers openly source the component building blocks they require to accelerate their own projects, supply chain attacks will only continue to increase. These attack types present challenges all companies have experienced before - but they're more nuanced and even more frightening than the challenges of the past.

Supply Chain Attack Protection Challenges

What are best-in-class organizations doing to protect their systems from these attack types today? The answer is at once encouraging and disappointing: Not enough. But that's not unexpected given the many, unique challenges presented by supply chain attacks.