The software industry’s reliance on open source along with a sharp increase in open source software (OSS) dependencies helped to make supply chains a major security target. 64% of organizations were impacted by a software supply chain attack in the last year according to a recent report.  

The report, The 2022 State of the Software Supply Chain, was conducted by software and IoT  solution provider Revenera with data from over 100 Revenera audit services projects.

While open-source use awareness is the first step to building and maintaining a successful open source management strategy, close to 70% of organizations do not have company-wide policies for properly using open source.

The Revenera audit team identified 12% more issues in 2021 over the prior year, with 2,200 issues uncovered per audit project compared to 1,959 in 2020. 61% of the scanned codebase files were attributed to open source, up 6 percentage points from 2020. 

Also, compared to 2020, Revenera found a 7% increase in binaries, which are more complex than source code in that they often have combined IP from multiple sources and are made up of many constituent files. 

In all, software supply chain attacks grew by more than 300% in 2021 compared to 2020, according to a study by Argon Security, which was recently acquired by Aqua Security. Revenera’s audit team uncovered 282 security vulnerabilities per audit project, an increase of 217% over 2020. 27 percent of those vulnerabilities have a “high” CVSS severity rating. Despite this, the level of security across the software development life cycle remains low.

However, some companies are trying to mitigate security risks through new regulations and Software Bill of Materials (SBOM). 

The industry and markets continue to respond to software supply chain and security risk by increasing regulations aimed at discovering and tracking open source issues through organizations and regulations such as NIST, PCI, OpenChain, OWASP, MITRE, NHTSA, and GDPR.

An executive order in May started prioritizing the SBOM by stating that any software provider that sells software to the federal government must provide an SBOM. 

“As industries and governing bodies increase governance requirements and more companies require an SBOM from software suppliers as part of the contractual process to prove software supply chain security, having a complete, accurate inventory of what’s in code will most likely become the norm rather than the exception,” the report stated. 

Revenera suggested that these are the six steps to better secure the software supply chain: 

  1. “Understand the construction of the software pipeline and how software sources, components and packages gain entry.
  2. Produce a precise SBOM that includes all subcomponents, hidden dependencies and associated licenses.
  3. Shift vulnerability management and license compliance left to minimize and mitigate open source risk early in the devops lifecycle.
  4. Collaborate with key stakeholders across the organization
  5. Empower software developers by providing ongoing education for security vulnerability and license compliance management.
  6. Implement an SCA solution that identifies both security and license compliance issue in code.”