Zooming across the Software Supply Chain
By: Fsi Student Programs
Tags: Fsi Students, Stanford, Cyber Policy, Internships

About the author: June Lee ’21 is an FSI Global Policy Intern with the Cyber Statecraft Initiative. She is currently an International Relations major at Stanford University.

Something I have really enjoyed about interning at a think tank is the opportunity to engage with diverse individuals and groups that all have a stake in a particular policy issue, and piece together how their perspectives are represented in current policies and technical features. For the past few weeks, we have been presenting the Cyber Statecraft Initiative’s newest report, “Breaking Trust: Shades of crisis across an insecure supply chain,” to stakeholder groups in the private sector, government, and academia; receiving feedback; and discussing opportunities and challenges for better securing the software supply chain. As we jumped from Zoom call to Zoom call, it has been fascinating to gain exposure to the diverse yet nuanced perspectives that underlie the issue.

Attending an Atlantic Council “Front Page” event with the Prime Minister of Singapore!

In the tech sector, I’ve been surprised by the different approaches that companies within a single industry take to policy developments. For instance, one of the biggest challenges of securing software are the complex dependencies of the software supply chain, many of which are not even known by end users that purchase software products (e.g. software products are often created using code from open source and commercial software components, which, in turn, depend on code from other codebases). The federal government, led by the National Telecommunications & Information Administration, has advocated for widespread adoption of a software bill of materials (SBOM), which lists all the components in a software product, similar to the ingredients list on a food label. Teams from different tech companies had surprisingly wide-ranging views of the SBOM effort, despite being similarly affected by relevant requirements.

During conversations with tech companies, I’ve also been fascinated by the broad range of expertise and perspectives found within a single firm. With engineering teams, we’ve dived into deep discussions about the potential technical solutions to vulnerability disclosure and efforts to map the software supply chain. With policy teams, we’ve elaborated on the implementation of these tools and potential obstacles in high-level policy processes. Each conversation illuminated a different aspect of the security landscape facing the tech sector, and I’ve enjoyed piecing together how different groups within a company work together to ensure that new, innovative products adhere to relevant security standards.

Conversations with security researchers provided another unique perspective on the software ecosystem and the manner in which different security practices impact the incentives and behavior of diverse actors in this space. As policymakers strive to bring together the diverse priorities and capabilities of entities in the software supply chain, I was struck by the immensity of the challenge facing federal agencies in this space.

I’m grateful for how supportive the team at CSI has been, letting the interns participate in a broad variety of briefings and roundtables, answering all of our questions — on everything from open-source software governance to growing professionally in DC — and even adding us to the team’s weekly Spotify playlist (in short: it’s amazing). With just a few weeks remaining in my internship, I’m looking forward to wrapping up some final projects and squeezing every minute I can out of the internship experience. See you in a couple of weeks!