The State of Software Supply Chain Security 2024: It's a Big Deal

January 18, 2024

In this episode of ReversingGlass, Matt reviews the new report from ReversingLabs, The State of Software Supply Chain Security 2024, and highlights some of the key takeaways. In short: It's a big deal.

Learn More

- Learn more: The State of Software Supply Chain Security 2024: Key takeaways
- Get report: The State of Software Supply Chain Security 2024
- Related: Software supply chain security risks addressed in new Gartner report

Episode Transcript

MATT ROSE: Hi everyone. Welcome back to another episode of ReversingGlass. I'm Matt Rose, Field CISO at ReversingLabs. Very excited about this episode because it's a culmination, or a research project. It's going to talk about The State of Software Supply Chain Security 2024 research report that was created by a friend of mine and colleague Paul Roberts.

He was the one that spearheaded this report. And there's a ton of great information. From a standpoint of I'm giving you a sneak preview here. This is the report, the cover of the report. It's a very comprehensive report, but if you haven't guessed, software supply chain security or software supply chain, in general is kind of a big thing.

We'll borrow from Ron Burgundy here, and if you didn't know this, software supply chain security is kind of a big deal these days. But what does that mean? What are the kind of inner workings of this report? Well, I don't know if you guys know this, and I suggest everybody gets to the report, downloads the report and reads it.

But did you know that there were 12 major SSCS or software supply chain security breaches in the past year? Everyone knows kind of the big ones, but there's some underlying ones that are really important. So reading this report, you'll kind of dig into some of those things, but 12 major software supply chain security attacks in the past year.

That sounds like a dark cloud on the horizon, if you will. From a standpoint of the explosive growth of malware, this report talks about, and I'm not a big metrics guy, there's a ton of metrics and analytics within the report, but there was a 23 percent increase in malicious packages on npm and PyPI last year.

That's a 23 percent increase, but guess what? That was only in the first nine months of 2023 over 2022. So there was some more in there. And if you think about it too, from 2020, let me get my notes here. Yeah, to 2023, there has been a 1300 percent increase in vulnerable packaging in open source repos. Combine this with your first party code, with the potential compromise of the

tooling associated with the supply chain, the build environments, the code repos, all these type of things. This is the here and now. And as Ron Burgundy says, it is a big thing. So if you're not addressing software supply chain security in a way that not only identifies the how software supply chain attacks happen... you know, was it a secrets compromise?

Was it a build compromise? Was it a code repo compromise? Was it a credential compromise? There are many different ways that this can happen. Software supply chain security is a big thing to the point where new government agencies have been created just to address this topic. So ReversingLabs' The State of Software Supply Chain Security 2024 coming out for your pleasure for your reading, but you're going to learn a lot from this report. Again,

I appreciate Paul Roberts putting in all the work and effort on this, but this is, in my view, a foundational document to talk about where software supply chain security has been and where it's going into 2024. I'm Matt Rose, Field CISO at ReversingLabs. Thanks for watching and I hope you have a great day.

Matt Rose

About Author: Matt Rose

Field CISO at ReversingLabs. Matt Rose has an extensive background in application security, object-oriented programming, multi-tier architecture design and implementation, and internet/intranet development. His areas of expertise include Application Security, SAST, DAST, IAST, SCA, DevSecOps, and Threat Modeling. Matt is an accomplished public speaker and has been quoted in 50+ AST industry media publications.

Related episodes

Artificial Intelligence (AI)/Machine Learning (ML)

ReversingGlass: EO on AI: What security teams need to know

ReversingGlass

Shift Up Your SBOM

Artificial Intelligence (AI)/Machine Learning (ML)

AI and Software Supply Chain Security: Proceed with Caution

ReversingGlass

What the heck is an SBOM?

ReversingGlass

What is ReversingGlass?

Subscribe

Sign up now to receive the latest weekly
news from ReversingLabs

Get Started
Request a DEMO

Learn more about how ReversingLabs can help your company reduce attack surface risks with deep software and file threat analysis to speed release and response. 

REQUEST A DEMO