{"id":8014,"date":"2022-06-09T11:49:57","date_gmt":"2022-06-09T11:49:57","guid":{"rendered":"https:\/\/outofsite.biz\/cynance\/?p=8014"},"modified":"2022-06-09T11:50:53","modified_gmt":"2022-06-09T11:50:53","slug":"how-to-prevent-software-supply-chain-attacks","status":"publish","type":"post","link":"https:\/\/outofsite.biz\/cynance\/how-to-prevent-software-supply-chain-attacks\/","title":{"rendered":"Are you the weakest link? How to prevent software supply chain attacks"},"content":{"rendered":"\t\t<div data-elementor-type=\"wp-post\" data-elementor-id=\"8014\" class=\"elementor elementor-8014\">\n\t\t\t\t\t\t\t\t\t<section class=\"elementor-section elementor-top-section elementor-element elementor-element-45e0897e elementor-section-boxed elementor-section-height-default elementor-section-height-default\" data-id=\"45e0897e\" data-element_type=\"section\">\n\t\t\t\t\t\t<div class=\"elementor-container elementor-column-gap-default\">\n\t\t\t\t\t<div class=\"elementor-column elementor-col-100 elementor-top-column elementor-element elementor-element-2a13f229\" data-id=\"2a13f229\" data-element_type=\"column\">\n\t\t\t<div class=\"elementor-widget-wrap elementor-element-populated\">\n\t\t\t\t\t\t\t\t<div class=\"elementor-element elementor-element-264884f6 elementor-widget elementor-widget-text-editor\" data-id=\"264884f6\" data-element_type=\"widget\" data-widget_type=\"text-editor.default\">\n\t\t\t\t<div class=\"elementor-widget-container\">\n\t\t\t<style>\/*! elementor - v3.11.5 - 14-03-2023 *\/\n.elementor-widget-text-editor.elementor-drop-cap-view-stacked .elementor-drop-cap{background-color:#818a91;color:#fff}.elementor-widget-text-editor.elementor-drop-cap-view-framed .elementor-drop-cap{color:#818a91;border:3px solid;background-color:transparent}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap{margin-top:8px}.elementor-widget-text-editor:not(.elementor-drop-cap-view-default) .elementor-drop-cap-letter{width:1em;height:1em}.elementor-widget-text-editor .elementor-drop-cap{float:left;text-align:center;line-height:1;font-size:50px}.elementor-widget-text-editor .elementor-drop-cap-letter{display:inline-block}<\/style>\t\t\t\t<p><span style=\"font-weight: 400;\">The increasing prevalence of software supply chain attacks has grabbed headlines and industry attention alike. Where headlines may focus on victims (especially when there are high profile victims), within the cybersecurity industry the focus may be on the consequences of the attack for the supplier at the centre, and what this could mean for other similar companies.<\/span><\/p><p><span style=\"font-weight: 400;\">It is therefore important for organisations to take precautions to prevent software supply chain attacks originating from them, and how to avoid being <\/span><i><span style=\"font-weight: 400;\">that<\/span><\/i><span style=\"font-weight: 400;\"> supplier.<\/span><\/p><h2><span style=\"font-weight: 400;\">What are software supply chain attacks?<\/span><\/h2><p><a href=\"https:\/\/docs.microsoft.com\/en-us\/windows\/security\/threat-protection\/intelligence\/supply-chain-malware\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Software supply chain attacks<\/span><\/a><span style=\"font-weight: 400;\"> target software developers and suppliers in order to travel up and down their supply chain, ultimately gaining access to their customers.<\/span><\/p><p><span style=\"font-weight: 400;\">Software supply chain attacks are usually carried out for two motivations. The first motivation for a software supply chain attack is to gain access to multiple victims from just the one attack (an attack method known as a Watering Hole attack, and the ultimate in multiplier effects), for example as in the <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/kaseya-ransomware-attack-update\/\"><span style=\"font-weight: 400;\">Kaseya ransomware attack<\/span><\/a><span style=\"font-weight: 400;\"> in July 2021.<\/span><\/p><p><span style=\"font-weight: 400;\">The second motivation for a software supply chain attack is to gain access to a high profile victim by targeting a smaller, potentially less secure supplier, such as in the <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/us-treasury-cyber-attack-suppliers-in-the-spotlight\/\"><span style=\"font-weight: 400;\">SolarWinds software supply chain attack<\/span><\/a><span style=\"font-weight: 400;\"> in December 2020, where the supplier SolarWinds was used to gain access to key US government departments.<\/span><\/p><p><span style=\"font-weight: 400;\">The common perception from attackers, victims, and the wider security community, is that the software vendors at the centre of these attacks have poor security postures. This in turn will influence the response to that supplier in the aftermath of an attack. For example, note how these two attack examples above are referred to by the name of the supplier at the centre of the attack rather than the name of the attackers.<\/span><\/p><h2><span style=\"font-weight: 400;\">Why suppliers should take software supply chain attacks seriously<\/span><\/h2><p><b>Software supply chain attacks are increasing<\/b><\/p><p><span style=\"font-weight: 400;\">According to <\/span><a href=\"https:\/\/www.sonatype.com\/resources\/white-paper-2021-state-of-the-software-supply-chain-report-2021?hsLang=en-us\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Sonatype<\/span><\/a><span style=\"font-weight: 400;\">, 2021 saw a staggering 650% increase in software supply chain attacks aimed at exploiting weaknesses in upstream open source ecosystems. This compares to a 430% increase in 2020, which was the year that brought supply chain attacks into the mainstream.<\/span><\/p><p><b>Software supply chain attacks are a major concern for organisations of all sizes and industries <\/b><span style=\"font-weight: 400;\">\u00a0<\/span><\/p><p><a href=\"https:\/\/www.crowdstrike.com\/resources\/reports\/global-security-attitude-survey-2021\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">CrowdStrike<\/span><\/a><span style=\"font-weight: 400;\">\u2019s Global Security Attitude Survey 2021 found that 45% of organisations experienced at least one software supply chain attack in the previous 12 months, and that 84% of organisations believe that supply chain attacks could pose one of the biggest cyber threats to their organisations. As a result, companies have begun to investigate the security posture of their suppliers in more depth.<\/span><\/p><p><span style=\"font-weight: 400;\">For suppliers, they can now expect more scrutiny, typically through security questionnaires, but also including evidence of audits or penetration tests or requirements by a potential customer to carry out an audit or testing as part of the sales process.<\/span><\/p><p><b>Software supply chain attacks can be catastrophic for business<\/b><\/p><p><span style=\"font-weight: 400;\">Taking just one example, that of SolarWinds, being at the heart of a software supply chain attack has severely impacted their bottom line. In January 2021 a class action lawsuit was filed against them because of their security failures which led to their compromise. Their share price has also crashed. In December 2020, the share price was $47.40 and over the past year it has fallen in several stages to a current price of around $13.00 in April 2022 (a drop of over 70%!).<\/span><\/p><p><b>New regulations targeting supply chain cybersecurity<\/b><\/p><p><span style=\"font-weight: 400;\">Supplier security has caught the eye of governments. The UK government carried out an <\/span><a href=\"https:\/\/www.gov.uk\/government\/publications\/government-response-on-supply-chain-cyber-security\/government-response-to-the-call-for-views-on-supply-chain-cyber-security\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">enquiry into supplier chain cybersecurity<\/span><\/a><span style=\"font-weight: 400;\"> in 2021, and subsequently announced that supply chain cybersecurity could become subject to law, for example through requiring businesses to adhere to the NCSC Cyber Assessment Framework.<\/span><\/p><p><span style=\"font-weight: 400;\">In the United States, following the Colonial Pipeline ransomware attack in May, the government issued Executive Order 14028 on \u201c<\/span><a href=\"https:\/\/www.whitehouse.gov\/briefing-room\/presidential-actions\/2021\/05\/12\/executive-order-on-improving-the-nations-cybersecurity\/\" target=\"_blank\" rel=\"noopener\"><span style=\"font-weight: 400;\">Improving the Nation\u2019s Cybersecurity<\/span><\/a><span style=\"font-weight: 400;\">\u201d placing emphasis on the security and integrity of the software supply chain.<\/span><\/p><h2><span style=\"font-weight: 400;\">Types of software supply chain attacks<\/span><\/h2><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><b>Update hijacking:<\/b><span style=\"font-weight: 400;\"> Attackers hijack an update by infiltrating a vendor\u2019s network and inserting malware into the update, or altering the update to grant them control over the software within customer\u2019s networks.\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><b>Undermining code signing:<\/b><span style=\"font-weight: 400;\"> Attackers self-sign certificates, break signing systems, or exploit misconfigured account access controls in order to undermine code signed by the vendor\u2019s developers. This enables the attacker to hijack software updates by impersonating the trusted vendor and inserting malicious code into an update.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><b>Compromised open-source code:<\/b><span style=\"font-weight: 400;\"> Threat actors insert malicious code into publicly accessible code libraries which can then be added to products by unsuspecting developers, giving the attackers access to any number of downstream code.<\/span><\/li><\/ul><h2><span style=\"font-weight: 400;\">How to avoid becoming a software supply chain catastrophe<\/span><\/h2><p><span style=\"font-weight: 400;\">Software vendors and developers should take the following precautions to reduce the risk of compromise which could turn into a software supply chain attack.<\/span><\/p><p><b>Incorporate security at every point of the <\/b><a href=\"https:\/\/outofsite.biz\/cynance\/application-security\/secure-software-development-life-cycle-ssdlc\/\"><b>software development life cycle<\/b><\/a><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Implement secure coding practices.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Identify threats to the software and develop securely to reduce their risk.\u00a0<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Implement SSL for all update channels.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Implement certificate pinning.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Sign all code, including configuration files, scripts, XML, and packages.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Verify the security of all third party libraries, packages, and dependencies incorporated into code.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Establish the security posture of the product with third party <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/application-security\/penetration-testing\/\"><span style=\"font-weight: 400;\">penetration testing<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/li><\/ul><p><b>Protect the environment surrounding the product<\/b><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Avoid update hijacks by ensuring that the build and update infrastructure is <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/infrastructure-security\/network-security\/\"><span style=\"font-weight: 400;\">highly secure<\/span><\/a><span style=\"font-weight: 400;\">.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Scan operating system and software patches for all tools in use in the infrastructure prior to deployment.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Validate the update source before applying tool updates.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Verify the security of tool suppliers.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Restrict access to critical systems, utilise the principle of least privilege, and require multi-factor authentication.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Monitor use of privilege accounts.<\/span><\/li><\/ul><p><b>Be prepared for supply chain attacks<\/b><\/p><ul><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Develop and rehearse <\/span><a href=\"https:\/\/outofsite.biz\/cynance\/guide-to-cyber-security-incident-response-planning\/\"><span style=\"font-weight: 400;\">incident response plans<\/span><\/a><span style=\"font-weight: 400;\"> to respond quickly and effectively in the event of an attack, and limit their damage.<\/span><\/li><li style=\"font-weight: 400;\" aria-level=\"1\"><span style=\"font-weight: 400;\">Incident response plans must include processes for timely and accurate notifications to customers and authorities.<\/span><\/li><\/ul><p><span style=\"font-weight: 400;\">Software supply chain attacks can happen to any organisation, no matter their size. But for small software vendors whose success relies on their reputation, being central to a software supply chain attack can be catastrophic. The security of products in the supply chain is under more scrutiny than ever, making it imperative that organisations place additional emphasis on their security.<\/span><\/p><p><span style=\"font-weight: 400;\">Stay safe<\/span><\/p>\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t\t\t\t<\/div>\n\t\t","protected":false},"excerpt":{"rendered":"<p>The increasing prevalence of software supply chain attacks has grabbed headlines and industry attention alike. Where headlines may focus on victims (especially when there are high profile victims), within the cybersecurity industry the focus may be on the consequences of the attack for the supplier at the centre, and what this could mean for other&hellip;<\/p>\n","protected":false},"author":10,"featured_media":8023,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[63,62],"_links":{"self":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/8014"}],"collection":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/users\/10"}],"replies":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/comments?post=8014"}],"version-history":[{"count":8,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/8014\/revisions"}],"predecessor-version":[{"id":8022,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/posts\/8014\/revisions\/8022"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media\/8023"}],"wp:attachment":[{"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/media?parent=8014"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/categories?post=8014"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/outofsite.biz\/cynance\/wp-json\/wp\/v2\/tags?post=8014"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}