Get rid of your monolithic software supply chain
By: Nick Matlach
Tags: Security, Infosec, Supply Chain, Cybersecurity, Software Development

This month has demonstrated that no software supply chain is strong enough to withstand a determined cyber attacker. Instead of building stronger supply chains, consider creating multiple supply chains with overlapping capabilities for your critical business processes.

TL; DR

FireEye, a cybersecurity firm, had their tool SolarWinds breached by a hacking group believed to be affiliated with the Russian Government.

The hack caused SolarWinds to distribute trojan viruses to Fortune 500 companies, all branches of the US military, the Pentagon, and the US State Department, among others.

No one is immune from the interconnected web of software supply chain dependencies of their own internal or 3rd party applications.

To build a better supply chain, build multiple overlapping chains that watch each other in a “separation of duties” and “zero-trust” environment.

The unbreakable chain

Every organization is a hostage to its supply chain. Outsourcing is so pervasive that it has almost become irresponsible not to engage dozens of other organizations to deliver specialized services at a lower cost. For a Security Pro, this means running down the rabbit hole of subcontractors’ subcontractors and exhausting audit resources trying to find and mitigate the weakest link.

Supply Chain security can seem like an endless maze of subcontractors.

The recent hack of SolarWinds by FireEye should be sobering to anyone that relies upon a single vendor, tool, or product to deliver a critical business service. But these warnings have been here for a long time.

FireEye is one of the world’s top cybersecurity firms with major government and enterprise customers around the world. The company is known for its top-notch research on state-sponsored threat actors and its incident response capabilities. Over the years it was called to investigate some of the most high-profile breaches in governments and organizations.

For example, on March 22, 2016, Azer Koçulu, a 28-year-old programmer, deleted ‘left-pad’ (along with 273 other packages), 11 lines of elementary javascript, designed to add characters to the beginning of a string. The code is so simple that most programmers could be taught to write it within their first week of programming. However, instead of writing this code, React (a popular Javascript framework created by Facebook with ~250k daily downloads in 2016) developers included ‘left-pad’ as a dependency. This means that every organization that trusted React was also trusting Azer, and they all had to rebuild their applications when Azer took his code off the Internet. If anything, this problem has only gotten worse since 2016.

Building mighty chains

Your Security Pro, even with an unlimited budget and countless analysts, could not evaluate every node, patch, update, or line of code in the interconnected web of your organization's software supply chain. Similarly, your attorneys cant write contracts long enough to mitigate the risk of one node’s node being vulnerable to state-sponsored cyber attacks. So how does an organization build a mighty chain that keeps the organization running even during an attack?

Define your business-critical systems and workflows Use separation of duties to break up segments of the critical paths between vendors. Overlap capability sets to reduce single points of failure. Implement a “zero trust” environment for every node in your supply chain, with each node watching and supporting the other nodes. Minimize overlapping dependencies. Demand a comprehensive security plan from each vendor, and ensure that plan asks for one from each node in its critical path.

Break up all of the single supply chains holding you back from achieving operational reliance in your business process.

Many organizations seek out monolithic apparatuses with proven track records of performance in their industry to reduce complexity and costs. The vulnerability we learned this month is that no one is immune from cyberattacks, and every single point of failure will fail, given enough time and pressure. Multiple adequate supply chains will provide better protection than one monolith.