May 25, 2022

Software Supply Chain Attacks Surged In 2021 Community Chats Webinars Library Software Supply Chain Attacks Surged In 2021 brooke.crothers Application security teams are facing massive challenges The SolarWinds attack is considered to be one of the largest and most sophisticated supply chain attacks to date and exemplifies the devastating potential of supply chain attacks. SolarWinds was followed by a similar build-time code-manipulation attack, in which attackers penetrated Codecov product’s software supply chain , manipulating the build process to inject malicious code into its software and using the software update mechanism to distribute the malware to Codecov customers. In July 2021, the attack on Kaseya raised awareness of the downstream effects of supply chain attacks. In this attack, a managed service provider software was used to distribute the REvil ransomware to the managed service provider’s customers, causing significant downtime and revenue loss. The year’s final incident would come in December, when the Log4J vulnerability was discovered and forced software vendors into a patching panic. Shortly after the discovery, attackers started to exploit this popular package and take advantage of this vulnerability to launch their attacks. “The number of attacks over the past year and the widespread impact of a single attack highlights the massive challenge that application security teams are facing,” said Eran Orzel, Senior Director of Argon Customer Success and Sales. Examining the success rate and consequent damage of the many attacks in 2021, one of the most evident details is that current security tools and practices are not adequate for preventing supply chain attacks. Traditional application security testing cannot detect supply chain attacks. Additionally, established CI/CD (continuous integration, continuous delivery) and DevOps pipelines rely on implicit permissions to enable rapid commits and deployment, implementing security controls only at the end of this process, which is too late to preclude malicious activity. Three main risk areas The analysis made by Argon Security researchers highlighted three main risks that companies developing software need to focus upon. Use of vulnerable software packages Open source code is part of almost all commercial software. Many of the open source components used today have existing vulnerabilities. Upgrading to a more secure version requires effort from development and DevOps teams. As a result, most companies are lagging in vulnerability remediation, even when it comes to high severity vulnerabilities. There are two common attacks that leverage vulnerable software packages: Exploiting existing vulnerabilities to obtain access to the application and execute the attack Planting malicious code in popular open source packages and private packages to trick developers or automated pipeline tools into incorporating them as part of the application build process. Compromised pipeline tools Taking advantage of privileged access, misconfigurations, and vulnerabilities in the CI/CD pipeline infrastructure can give attackers access to critical IT infrastructure, development processes, source code, and other application artifacts. A compromised CI/CD pipeline can expose an application’s source code, which is the blueprint of the application, the development infrastructure, and processes. It enables attackers to change code or inject malicious code during the build process and tamper with the application. This type of breach is hard to identify and can cause a lot of damage before it is detected and resolved. Code and artifact integrity The upload of bad code to source code repositories directly impacts artifact quality and security posture. Common issues that were found in most customer environments were sensitive data in code, code quality and security issues, infrastructure as code issues, container image vulnerabilities and misconfigurations. Many issues that were discovered required time-intensive cleanup projects to reduce exposure. How code signing can protect your organization Code signing is a critical security control that provides software with a machine identity, which verifies its legitimacy. These machine identities are in the form of digital certificates and private keys, both of which must be secured. To truly secure code signing private keys, you have to secure the process by which they get used without inconveniencing the developers that need to use them. You need to support developers’ existing tool chains and work within their current processes, such as DevOps. The following code signing best practices can help you improve the security of your software development projects: Centrally secure all your private keys Create strong code signing policies and automatically enforce them through workflow automation Identify roles, responsibilities and the approval process Secure an automated code signing process across the overall CI/CD pipelines Integrate with current tools and environments to make code signing fast and easy for your DevOps teams Maintain an irrefutable record of all code signing activities Venafi and Veracode Venafi and Veracode with contributions from Sophos and Cloudbees have developed the “Blueprint for building modern, secure software development pipelines.” It aims at reducing risk and aligning with agile, high performance software development pipelines. The blueprint proposes a standard set of controls to secure software development pipelines for CI/CD against attack. The ultimate goal of the blueprint is to minimize the possibility of supply chain attacks. Download “ Code Signing Machine Identity Management for Dummies ” eBook and discover why cybercriminals target code signing machine identities and how effective management and secure processes keep yours safe Related Posts