The State of SSCS 2024: It's a Big Deal

In this episode of ReversingGlass, Matt reviews the new report from ReversingLabs, The State of Software Supply Chain Security 2024, and highlights some of the key takeaways. In short: It's a big deal.

Learn More

- Learn more: The State of Software Supply Chain Security 2024: Key takeaways
- Get report: The State of Software Supply Chain Security 2024
- Related: Software supply chain security risks addressed in new Gartner report

Episode Transcript

MATT ROSE: Hi everyone. Welcome back to another episode of ReversingGlass. I'm Matt Rose, Field CISO at ReversingLabs. Very excited about this episode because it's a culmination, or a research project. It's going to talk about The State of Software Supply Chain Security 2024 research report that was created by a friend of mine and colleague Paul Roberts.

He was the one that spearheaded this report. And there's a ton of great information. From a standpoint of I'm giving you a sneak preview here. This is the report, the cover of the report. It's a very comprehensive report, but if you haven't guessed, software supply chain security or software supply chain, in general is kind of a big thing.

We'll borrow from Ron Burgundy here, and if you didn't know this, software supply chain security is kind of a big deal these days. But what does that mean? What are the kind of inner workings of this report? Well, I don't know if you guys know this, and I suggest everybody gets to the report, downloads the report and reads it.

But did you know that there were 12 major SSCS or software supply chain security breaches in the past year? Everyone knows kind of the big ones, but there's some underlying ones that are really important. So reading this report, you'll kind of dig into some of those things, but 12 major software supply chain security attacks in the past year.

That sounds like a dark cloud on the horizon, if you will. From a standpoint of the explosive growth of malware, this report talks about, and I'm not a big metrics guy, there's a ton of metrics and analytics within the report, but there was a 23 percent increase in malicious packages on npm and PyPI last year.

That's a 23 percent increase, but guess what? That was only in the first nine months of 2023 over 2022. So there was some more in there. And if you think about it too, from 2020, let me get my notes here. Yeah, to 2023, there has been a 1300 percent increase in vulnerable packaging in open source repos. Combine this with your first party code, with the potential compromise of the