Code Supply Chain Security

Question

Code Supply Chain Security

Steve Jones - SSC Editor

SSC Guru

Points: 736173
More actions
October 12, 2022 at 12:00 am

#4095958

Comments posted to this topic are about the item Code Supply Chain Security

Viewing 4 posts - 1 through 3 (of 3 total)

You must be logged in to reply to this topic. Login to reply

Rod at work SSC-Dedicated Points: 34007 More actions · Answer 1

Thank you very much, Steve, for this article. And especially for the links you've provided to help developers better secure their software. I've been looking for something like this for a long time, so I greatly appreciate it.

Kindest Regards, Rod Connect with me on LinkedIn.

David.Poole SSC Guru Points: 76000 More actions · Answer 2

Many of our applications are put in Docker containers. These containers are scanned using Trivy , which catches a frightening number of items. We also use scanners on our Docker build process itself to ensure that we are not introducing vulnerabilities through other means.

The choice as to how current to keep patching levels is a trade off.

Older software might be more stable but vulnerabilities can be discovered
Newer software might be patched against old vulnerabilities but be less stable or even introduce other vulnerabilities.

Damned if you do, damned if you don't.

For data pipeline applications we think carefully about what we need and whether we can reduce the number of dependencies. Something like MiniConda for Python is convenient for experimentation but stuffed with far more dependencies than I'd ever need for production code.

Another pain point is the escalation process (the lack thereof) for vendor software. If we find a vulnerability it can feel a thankless task reporting it. In some cases we find unpatched vulnerabilities that are years old.

I think we've all seen applications that require an SA login, and worse, a hard-coded SA password.

Now more than ever we need multi-factor-authentication for our corporate applications, and to access our workstations. The peace of mind outweighs the minor inconvenience.

I think we have a way to go before supply chain attack has the prominence it deserves.

LinkedIn Profile

Steve Jones - SSC Editor SSC Guru Points: 736173 More actions · Answer 3

I think this is likely to become more of an issue in the future. Hopefully, we find some better solutions that don't dampen the enthusiasm for using OSS stuff in corporate work.