In this episode of ReversingGlass, Matt reviews the new report from ReversingLabs, The State of Software Supply Chain Security 2024, and highlights some of the key takeaways. In short: It's a big deal.

Learn More

- Learn more: The State of Software Supply Chain Security 2024: Key takeaways
- Get report: The State of Software Supply Chain Security 2024
- Related: Software supply chain security risks addressed in new Gartner report

Episode Transcript

MATT ROSE: Hi everyone. Welcome back to another episode of ReversingGlass. I'm Matt Rose, Field CISO at ReversingLabs. Very excited about this episode because it's a culmination, or a research project. It's going to talk about The State of Software Supply Chain Security 2024 research report that was created by a friend of mine and colleague Paul Roberts.

He was the one that spearheaded this report. And there's a ton of great information. From a standpoint of I'm giving you a sneak preview here. This is the report, the cover of the report. It's a very comprehensive report, but if you haven't guessed, software supply chain security or software supply chain, in general is kind of a big thing.

We'll borrow from Ron Burgundy here, and if you didn't know this, software supply chain security is kind of a big deal these days. But what does that mean? What are the kind of inner workings of this report? Well, I don't know if you guys know this, and I suggest everybody gets to the report, downloads the report and reads it.

But did you know that there were 12 major SSCS or software supply chain security breaches in the past year? Everyone knows kind of the big ones, but there's some underlying ones that are really important. So reading this report, you'll kind of dig into some of those things, but 12 major software supply chain security attacks in the past year.

That sounds like a dark cloud on the horizon, if you will. From a standpoint of the explosive growth of malware, this report talks about, and I'm not a big metrics guy, there's a ton of metrics and analytics within the report, but there was a 23 percent increase in malicious packages on npm and PyPI last year.

That's a 23 percent increase, but guess what? That was only in the first nine months of 2023 over 2022. So there was some more in there. And if you think about it too, from 2020, let me get my notes here. Yeah, to 2023, there has been a 1300 percent increase in vulnerable packaging in open source repos. Combine this with your first party code, with the potential compromise of the

tooling associated with the supply chain, the build environments, the code repos, all these type of things. This is the here and now. And as Ron Burgundy says, it is a big thing. So if you're not addressing software supply chain security in a way that not only identifies the how software supply chain attacks happen... you know, was it a secrets compromise?

Was it a build compromise? Was it a code repo compromise? Was it a credential compromise? There are many different ways that this can happen. Software supply chain security is a big thing to the point where new government agencies have been created just to address this topic. So ReversingLabs' The State of Software Supply Chain Security 2024 coming out for your pleasure for your reading, but you're going to learn a lot from this report. Again,

I appreciate Paul Roberts putting in all the work and effort on this, but this is, in my view, a foundational document to talk about where software supply chain security has been and where it's going into 2024. I'm Matt Rose, Field CISO at ReversingLabs. Thanks for watching and I hope you have a great day.