Software Supply Chain Security in a Nutshell<\/h2>\n\n\n\n
The analyst firm Gartner provides a succinct definition: \u201cSoftware supply chain security (SSCS) is the set of processes and tools used to curate, create and consume software in ways that mitigate attacks against software or its use as an attack vector. Curation focuses on assessing risks of third-party software and assessing its acceptability. Creation focuses on secure development and the protection of software artifacts and the development pipeline. Consumption validates integrity of software through verification, provenance and traceability.\u201d <\/p>\n\n\n\n
Put more simply, it\u2019s all the software you use and build into your software, plus how your developers write code and monitor the code after it\u2019s deployed. SolarWinds is probably the biggest known example of a software supply chain attack to date. Over 18,000 organizations were impacted, with some reports stating the attack cost those affected 11% of their revenue on average. Gartner estimates the cost of supply chain attacks will grow from $40 billion in 2023 to $138 billion in 2031. This is a big number that underlines the importance of supply chain security. As an example, the U.S. government has started asking its suppliers to include a software bill of materials (SBOM) from its suppliers. <\/p>\n\n\n\n
There are many aspects to creating a software supply chain security program. <\/p>\n\n\n\n
- \n
- Scan third-party code using a source code analysis (SCA) tool. <\/li>\n\n\n\n
- Enforce strong authentication on all internal software repositories to prevent unauthorized access. <\/li>\n\n\n\n
- All code needs to be scanned by static application security testing (SAST<\/a>) and dynamic application security testing (DAST)<\/a> before deployment into production.\u00a0<\/li>\n\n\n\n
- Scan running code for web supply chain attacks in production<\/li>\n<\/ul>\n\n\n\n
There\u2019s much more detail to what organizations need to do pre-deployment. The rest of this blog will focus on what happens to code that\u2019s already been deployed when web supply chain-delivered malware is identified.<\/p>\n\n\n\n
Open Source Repository Takeovers<\/h2>\n\n\n\n
When an unknown or untrusted person or organization takes over a code repository or distribution site, the risks are obvious. Polyfill was an interesting case in that the repository wasn\u2019t attacked or compromised; it was sold, and the library was manipulated under new ownership. <\/p>\n\n\n\n
Open-source libraries are particularly vulnerable to these types of takeovers as the original authors move on or lose access to their work. A recent study by Synopsys<\/a> found ninety-six percent of total codebases contain open source components \u2013 illustrating the potential impact of this issue.<\/p>\n\n\n\n
Trusting open-source distributions involves a combination of due diligence, community engagement, and technical verification to ensure that the software is secure, reliable, and suitable for your needs. Common approaches include examining project maturity and popularity, reviewing the license and checking update frequency. You want a well-maintained, well used distribution that has the minimum functionality required.<\/p>\n\n\n\n
How CyCognito Detects Polyfill.io<\/h2>\n\n\n\n
CyCognito identifies technologies (including third-party components like polyfill.io) used on websites and web applications. These are represented in the platform as common platform enumeration (CPE<\/a>) services. Here\u2019s how you do it.<\/p>\n\n\n\n
Step 1: Search for an Instance of polyfill.js library <\/h4>\n\n\n\n
CyCognito users can search their external attack surface for web applications that utilize polyfill using our advanced search feature. Organizations looking for polyfill.io instances simply run the filter \u201cservice contains \u2018polyfill.js\u2019 as shown in Figure 1 below. CyCognito\u2019s AI search feature can also be used, letting users enter the request in spoken English like \u201cshow me which web apps use polyfill.js.\u201d<\/p>\n\n\n\n
![\"\"](\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/unnamed-1280x113.webp\")
<\/figure>\n\n\n\nFigure 1. An Advanced Search filter that finds instances of polyfill.js<\/p>\n\n\n\n
Step 2: Review Details on Polyfill.js Usage<\/h4>\n\n\n\n
- Scan running code for web supply chain attacks in production<\/li>\n<\/ul>\n\n\n\n
![\"\"](\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/unnamed-1.webp\")
<\/figure>\n\n\n\n![\"\"](\"https:\/\/www.cycognito.com\/blog\/wp-content\/uploads\/unnamed-2.webp\")
<\/figure>\n\n\n\n