Software Transparency

CHRIS HUGHES is the co-founder and Chief Information Security Officer of Aquia. He is an Adjunct Professor for M.S. Cybersecurity programs at Capitol Technology University and the University of Maryland Global Campus, and a co-host of the Resilient Cyber Podcast. TONY TURNER has 25 years’ experience as a cybersecurity engineer, architect, consultant, executive, and community builder. He is the Founder of Opswright, a software company creating solutions for security engineering in critical infrastructure and leads the OWASP Orlando chapter.

Foreword xxi

Introduction xxv

Chapter 1 Background on Software Supply Chain Threats 1

Incentives for the Attacker 1

Threat Models 2

Threat Modeling Methodologies 3

Stride 3

Stride- LM 4

Open Worldwide Application Security Project (OWASP) Risk- Rating Methodology 4

Dread 5

Using Attack Trees 5

Threat Modeling Process 6

Landmark Case 1: SolarWinds 14

Landmark Case 2: Log4j 18

Landmark Case 3: Kaseya 21

What Can We Learn from These Cases? 23

Summary 24

Chapter 2 Existing Approaches— Traditional Vendor Risk Management 25

Assessments 25

SDL Assessments 28

Application Security Maturity Models 29

Governance 30

Design 30

Implementation 31

Verification 31

Operations 32

Application Security Assurance 32

Static Application Security Testing 33

Dynamic Application Security Testing 34

Interactive Application Security Testing 35

Mobile Application Security Testing 36

Software Composition Analysis 36

Hashing and Code Signing 37

Summary 39

Chapter 3 Vulnerability Databases and Scoring Methodologies 41

Common Vulnerabilities and Exposures 41

National Vulnerability Database 44

Software Identity Formats 46

Cpe 46

Software Identification Tagging 47

Purl 49

Sonatype OSS Index 50

Open Source Vulnerability Database 51

Global Security Database 52

Common Vulnerability Scoring System 54

Base Metrics 55

Temporal Metrics 57

Environmental Metrics 58

CVSS Rating Scale 58

Critiques 59

Exploit Prediction Scoring System 59

EPSS Model 60

EPSS Critiques 62

CISA’s Take 63

Common Security Advisory Framework 63

Vulnerability Exploitability eXchange 64

Stakeholder- Specific Vulnerability Categorization and Known Exploited Vulnerabilities 65

Moving Forward 69

Summary 70

Chapter 4 Rise of Software Bill of Materials 71

SBOM in Regulations: Failures and Successes 71

NTIA: Evangelizing the Need for SBOM 72

Industry Efforts: National Labs 77

SBOM Formats 78

Software Identification (SWID) Tags 79

CycloneDX 80

Software Package Data Exchange (SPDX) 81

Vulnerability Exploitability eXchange (VEX) and Vulnerability Disclosures 82

VEX Enters the Conversation 83

VEX: Adding Context and Clarity 84

VEX vs. VDR 85

Moving Forward 88

Using SBOM with Other Attestations 89

Source Authenticity 89

Build Attestations 90

Dependency Management and Verification 90

Sigstore 92

Adoption 93

Sigstore Components 93

Commit Signing 95

SBOM Critiques and Concerns 95

Visibility for the Attacker 96

Intellectual Property 97

Tooling and Operationalization 97

Summary 98

Chapter 5 Challenges in Software Transparency 99

Firmware and Embedded Software 99

Linux Firmware 99

Real- Time Operating System Firmware 100

Embedded Systems 100

Device- Specific SBOM 100

Open Source Software and Proprietary Code 101

User Software 105

Legacy Software 106

Secure Transport 107

Summary 108

Chapter 6 Cloud and Containerization 111

Shared Responsibility Model 112

Breakdown of the Shared Responsibility Model 112

Duties of the Shared Responsibility Model 112

The 4 Cs of Cloud Native Security 116

Containers 118

Kubernetes 123

Serverless Model 128

SaaSBOM and the Complexity of APIs 129

CycloneDX SaaSBOM 130

Tooling and Emerging Discussions 132

Usage in DevOps and DevSecOps 132

Summary 135

Chapter 7 Existing and Emerging Commercial Guidance 137

Supply Chain Levels for Software Artifacts 137

Google Graph for Understanding Artifact Composition 141

CIS Software Supply Chain Security Guide 144

Source Code 145

Build Pipelines 146

Dependencies 148

Artifacts 148

Deployment 149

CNCF’s Software Supply Chain Best Practices 150

Securing the Source Code 152

Securing Materials 154

Securing Build Pipelines 155

Securing Artifacts 157

Securing Deployments 157

CNCF’s Secure Software Factory Reference Architecture 157

The Secure Software Factory Reference Architecture 158

Core Components 159

Management Components 160

Distribution Components 160

Variables and Functionality 160

Wrapping It Up 161

Microsoft’s Secure Supply Chain Consumption Framework 161

S2C2F Practices 163

S2C2F Implementation Guide 166

OWASP Software Component Verification Standard 167

SCVS Levels 168

Level 1 168

Level 2 169

Level 3 169

Inventory 169

Software Bill of Materials 170

Build Environment 171

Package Management 171

Component Analysis 173

Pedigree and Provenance 173

Open Source Policy 174

OpenSSF Scorecard 175

Security Scorecards for Open Source Projects 175

How Can Organizations Make Use of the Scorecards Project? 177

The Path Ahead 178

Summary 178

Chapter 8 Existing and Emerging Government Guidance 179

Cybersecurity Supply Chain Risk Management Practices for Systems and Organizations 179

Critical Software 181

Security Measures for Critical Software 182

Software Verification 186

Threat Modeling 187

Automated Testing 187

Code- Based or Static Analysis and Dynamic Testing 188

Review for Hard-Coded Secrets 188

Run with Language- Provided Checks and Protection 189

Black- Box Test Cases 189

Code- Based Test Cases 189

Historical Test Cases 189

Fuzzing 190

Web Application Scanning 190

Check Included Software Components 190

NIST’s Secure Software Development Framework 191

SSDF Details 192

Prepare the Organization (PO) 193

Protect the Software (PS) 194

Produce Well- Secured Software (PW) 194

Respond to Vulnerabilities (RV) 196

NSAs: Securing the Software Supply Chain Guidance Series 197

Security Guidance for Software Developers 197

Secure Product Criteria and Management 199

Develop Secure Code 202

Verify Third- Party Components 204

Harden the Build Environment 206

Deliver the Code 207

NSA Appendices 207

Recommended Practices Guide for Suppliers 209

Prepare the Organization 209

Protect the Software 210

Produce Well- Secured Software 211

Respond to Vulnerabilities 213

Recommended Practices Guide for Customers 214

Summary 218

Chapter 9 Software Transparency in Operational Technology 219

The Kinetic Effect of Software 220

Legacy Software Risks 222

Ladder Logic and Setpoints in Control Systems 223

ICS Attack Surface 225

Smart Grid 227

Summary 228

Chapter 10 Practical Guidance for Suppliers 229

Vulnerability Disclosure and Response PSIRT 229

Product Security Incident Response Team (PSIRT) 231

To Share or Not to Share and How Much Is Too Much? 236

Copyleft, Licensing Concerns, and “As- Is” Code 238

Open Source Program Offices 240

Consistency Across Product Teams 242

Manual Effort vs. Automation and Accuracy 243

Summary 244

Chapter 11 Practical Guidance for Consumers 245

Thinking Broad and Deep 245

Do I Really Need an SBOM? 246

What Do I Do with It? 250

Receiving and Managing SBOMs at Scale 251

Reducing the Noise 253

The Divergent Workflow— I Can’t Just Apply a Patch? 254

Preparation 256

Identification 256

Analysis 257

Virtual Patch Creation 257

Implementation and Testing 258

Recovery and Follow- up 258

Long- Term Thinking 259

Summary 259

Chapter 12 Software Transparency Predictions 261

Emerging Efforts, Regulations, and Requirements 261

The Power of the U.S. Government Supply Chains to Affect Markets 267

Acceleration of Supply Chain Attacks 270

The Increasing Connectedness of Our Digital World 272

What Comes Next? 275

Index 283