39:51This recording is not available yet.
2020 State of the Software Supply Chain
Download resourcesCategories
About this session
Bryan Whyte of Sonatype walks through the findings of the sixth State of the Software Supply Chain report, produced with Gene Kim and Stephen Magill. He opens with the scale of open-source consumption (over a trillion npm downloads forecast this year) and shows how the window from disclosure to exploitation has collapsed: the Struts flaw led to the Equifax breach within three days in 2017, and SaltStack users were attacked three days after the April patch. He then describes next-generation supply-chain attacks, where adversaries inject malicious code upstream through typosquatting, maintainer-account takeover and tool tampering such as the Octopus Scanner, up 430 percent in a year, plus maintainers pulling packages such as left-pad. Citing Deming, he argues for fewer and better suppliers, a software bill of materials and a local binary repository. Research on 24,000 projects found that frequent releases and fast mean time to update predict security, while popularity does not. A survey of 679 enterprises clusters teams into four groups; the DevSecOps high performers deploy 15 times more often and fix vulnerable components 26 times faster.
Are we staking our future on a pace we haven’t yet learned to secure?
In a year long collaboration with Gene Kim and Dr. Stephen Magill, we objectively examined and empirically documented software release patterns and cybersecurity hygiene practices across 48,000 commercial development teams and open source projects. Our research uncovered different development and cybersecurity hygiene behaviors across open source software that we categorized as Exemplars, Laggards, Features First, and Cautious.
In this session, I will reveal the insights we uncovered. Attendees will learn which techniques, team structures and release patterns exemplary development teams have been championed at large enterprises and open source project alike. I’ll then share observations of exemplary DevSecOps practices that deliver 50% more commits, release new code 2.4X faster, and remediate security vulnerabilities 2.9X faster.
Finally, I will point toward where these practices will intersect with AI to enable machines to build better applications themselves.
Key takeaways
- Assume a public CVE will be exploited within days; build a rapid-upgrade posture so you can identify and update affected components in hours, not weeks.
- Stand up a binary repository proxy (Nexus Repository OSS is free) so builds never depend on a public registry that can be poisoned or lose a package.
- Pick open-source dependencies on mean time to update and release frequency, not popularity; the report found popular projects are often slow to update.
- Cut variability: consolidate the dozens of versions of the same component spread across applications down to a few sanctioned ones.
- Automate approval and policy enforcement in the build with software composition analysis and a software bill of materials; that is what separates DevSecOps high performers from security-first teams.
Speakers
Bryan Whyte
After earning my Masters in Electrical Engineering, I spent over 20 years developing software applications to test hardware such as Torpedoes, Circuit Boards and Digital Subscriber Line (xDSL) modems. During that time I was also able to contribute… Read moreRead less
After earning my Masters in Electrical Engineering, I spent over 20 years developing software applications to test hardware such as Torpedoes, Circuit Boards and Digital Subscriber Line (xDSL) modems. During that time I was also able to contribute to the product development for both Embedded and Distributed Enterprise Applications.
In 2015 I joined IBM Security as a Technical Pre-Sales Engineer focused on the AppScan tool suite for Static, Dynamic and Mobile Application Security Testing. After spending a few years in Application Security I decided to expand my Cybersecurity proficiency and became a Certified Information Systems Security Professional (CISSP).
I joined Sonatype in 2019 because the explosive growth of Open Source Software has made Software Composition Analysis a critical aspect of Application Security.
In my free time I enjoy spending time with my wife and two daughters, traveling, sampling craft beers and golfing (poorly).
