Top 4 focus areas for securing your software supply chain

The complexity of the software supply chain (SSC) has the potential to expose your organization to greater risk than ever before. In today’s fast-paced software development landscape, managing and securing the software supply chain is crucial for delivering reliable and trusted software releases. Thus, it’s important to assess whether your organization is set up to handle the continuous expansion of the open-source ecosystem and an ever-growing array of tools to incorporate into your supply chain.

Leaders who choose the right tools, processes, and practices for their organizations will be able to harness the power of the most diverse software supply chain we’ve ever seen and, in turn, solidify their security posture and secure their competitive advantage.

To help IT and security leaders prepare, we’ve compiled a comprehensive report that combines JFrog’s extensive usage data from millions of users, meticulous CVE analysis conducted by the JFrog Security Research Team and commissioned third-party survey data from 1,224 professionals in Security, Development, and Ops roles. Here, you’ll find a high-level synopsis of the report’s key findings and recommendations. You can also check out the full report.

This year’s report yielded four key themes:

1. An exploding software supply chain (SSC) with a vast range of languages and package types: While development organizations can and should take advantage of the programming languages best suited to the needs of their project, every additional programming language or package type creates an additional threat vector and another layer of complexity to manage, from both a DevOps and security perspective. For large companies especially, managing the secure use of 10+ technologies can be a nightmare without the right tools and processes in place.
2. Where risk is hiding (and where it’s not). While risk lies beyond the open-source ecosystem, not all reported vulnerabilities are worth spending time remediating. Traditional CVSS ratings look purely at the severity of the exploit as opposed to the likelihood it will be exploited, which requires context to make an effective assessment.
3. Security taking a toll on productivity: 40% of survey respondents said it typically takes a week or longer to get approval to use a new package/library, extending time to market for new apps and software updates. Additionally, approximately 25% of security teams’ time is spent remediating vulnerabilities, even when those vulnerabilities may be overrated or even non-exploitable given their current context.
4. The serious impact of AI/ML. While it’s exciting to see organizations taking an important step in bringing ML model development into their secure software supply chain by managing models alongside all their other software artifacts, organizations need to be intentional about how they’re leveraging AI-based tools and move quickly to adopt security best practices for model use.

In a nutshell, the overwhelming amount of change and the rate of expansion in terms of the tools, technologies, and languages available today has the potential to put a massive strain on organizations, but if managed properly, the power of an end-to-end software supply chain strategy can help companies leapfrog their competition.

Read the full report.

About Author

AndyC

Andy Curtis is an award-winning security consultant, researcher and public speaker. He has been working in the computer security industry since the early 1990s, having been employed by state and federal government, leading healthcare and banking providers across three continents. He has given talks about computer security for some of the world’s largest companies, worked with law enforcement agencies on investigations into hacking groups, and is a regular voice on TV and radio explaining IT security threats.

See author's posts