Software Supply Chain Security Best Practices

Recent software supply chain attacks have prompted the United States Senate to pass legislation bolstering cybersecurity training for federal procurement personnel. The Supply Chain Security Training Act mandates that agencies assess and mitigate supply chain risk throughout the acquisition lifecycle. The Department of Homeland Security, NIST, and other federal agencies are tasked with coordinating and enforcing this program.

Managing software supply chain risks requires not only securing your organization against direct attacks but also mitigating the risk of third-party and Nth-party data breaches that could disrupt your business.

What does Software Supply Chain Security mean for TPRM?

Your software supply chain refers to the applications that you use to provide services to your customers. In third-party risk management, software supply chain security involves identifying possible vulnerabilities in the underlying components within those applications and assessing their likelihood of being manipulated by cybercriminals.

Tighter cybersecurity provisions are essential to strengthening supply chain risk management, and we suggest all organizations – not just federal agencies – consider implementing the following best practices.

Software Supply Chain Security Best Practices

1. Enhance Vendor Due Diligence with Combined Internal and External Risk Assessments

To minimize the risk of third-party software supply chain disruptions, require solution providers to share information about their software development lifecycle, including:

• The origins of their source code
• Their quality assurance (QA) processes
• Their service level agreements (SLAs) for identifying and fixing vulnerabilities

While initial assessments can come from vendor questionnaires, these only provide a snapshot in time. Complement your supplier assessments with continuously updated vendor risk data from sources including:

• Criminal forums, onion pages, dark web special access forums, threat feeds, and paste sites for leaked credentials. Monitoring chatter on these sites can provide an early warning indicator that a supply chain partner has or will be targeted.
• Security communities, code repositories, vulnerability databases, and historical data breach notifications to regularly check vendor security hygiene.
• Reputational risk information, including adverse media coverage, inclusion on global sanctions lists, or ownership by a state-owned enterprise.

By keeping track of these intelligence sources, you maintain up-to-date insight into your suppliers' vulnerabilities, moving from static to dynamic supplier risk assessments.

However, beware of building an overly complex and potentially expensive risk-monitoring program. With hundreds of potential sources of cybersecurity and reputational intelligence, it’s easy to quickly become overwhelmed with uncorrelated data from disparate, separately licensed sources.

Choose platforms that centralize inputs from multiple intelligence sources, corroborate assessment outcomes, and meaningfully report on potential vendor risk exposure.