You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
**Supply-Chain Levels for Software Artifacts**, or **SLSA**_(pronounced "salsa")_, is a security framework providing guidance on building and delivering software securely.
Copy file name to clipboardExpand all lines: docs/software-supply-chain-security/index.mdx
+12-10Lines changed: 12 additions & 10 deletions
Original file line number
Diff line number
Diff line change
@@ -33,6 +33,8 @@ Supply chain attacks are not a new concept. A well-known example is the Trojan h
33
33
34
34
But hidden within the horse were Greek soldiers, who emerged at night to open the gates for their army, leading to Troy's fall. The Greeks didn't attack directly; they exploited trust in the "supply."
35
35
36
+
Supply chain attacks have become more sophisticated over time, but are still regular occurrences around the world on a daily basis. Think counterfeit goods, tampered machinery and materials, to name just a few.
37
+
36
38
In software, supply chain attacks work similarly: attackers corrupt a trusted source or process, leading to widespread compromise. As a consumer, how can you be certain that the software you receive hasn't been tampered with along the way?
37
39
38
40
## Shifting Left: Evolution of Attacks
@@ -45,19 +47,21 @@ Over time, attackers have shifted their focus further up the chain. Instead of t
45
47
46
48
In parallel, they employ broader tactics like ransomware, data breaches, and intellectual property theft, disrupting supply chains and rendering organizations unable to deliver their products or services.
47
49
50
+
One example of a recent supply chain attack was the SolarWinds hack in 2020. Hackers infiltrated the build process of SolarWinds' Orion software (a popular IP network management tool) and added malware to an update, causing customers who trusted in SolarWinds to install the malware unknowingly.
51
+
48
52
:::info[Did You Know?]
49
53
50
54
1 in 5 data breaches is a software supply chain attack.
51
55
52
56
:::
53
57
54
-
This raises a critical question: **What if the code you trust the most is what makes your systems vulnerable?**
58
+
These events raise a critical question: **What if the code you trust the most is what makes your systems vulnerable?**
55
59
56
-
In many cases, there’s no guarantee that the software we run is the same as the software we built. This gap creates opportunities for attackers to exploit.
60
+
In many cases, there is no guarantee that the software we run is the same as the software we built. This gap creates opportunities for attackers to exploit.
57
61
58
62
### Who is involved in a supply chain?
59
63
60
-
If your organization provides products or services to others, your organization is part of the supply chain. Imagine making a pizza:
64
+
If your organization provides products or services to others, your organization is part of the supply chain. Imagine the steps involved in making a pizza:
61
65
62
66
1. A farmer grows tomatoes.
63
67
2. A factory turns tomatoes into sauce.
@@ -66,21 +70,19 @@ If your organization provides products or services to others, your organization
66
70
5. A pizzeria assembles the ingredients into a pizza.
67
71
6. The pizza is delivered to your door.
68
72
69
-
Each step involves different participants, each contributing to the final product. If any part of this process is disrupted or tampered with, the quality and safety of the pizza are at risk.
73
+
Each step involves different participants, each contributing to the final product. If _any_ part of this process is disrupted or tampered with, the quality and safety of the pizza are at risk. Software supply chains don't operate all that differently. Let's take a closer look in the next section.
70
74
71
75
### Software Supply Chains
72
76
73
-
Software supply chains operate similarly to traditional supply chains. Here's a simplified view:
77
+
A **software supply chain** is an interconnected network of people, processes, software libraries, firmware, and technologies used in the creation, development, publication, production, and distribution of digital products. The primary difference to general supply chain security is the software or firmware development and its distribution.
78
+
79
+
Here is a simplified view of a software supply chain:
74
80
75
81
```mermaid
76
82
flowchart LR
77
83
Source-->Build
78
84
Build-->Deploy
79
85
Deploy-->Monitor
80
-
click Source callback "Tooltip for a callback"
81
-
click Build "#" "This is a tooltip for a link"
82
-
click C call callback() "Tooltip for a callback"
83
-
click D href "#" "This is a tooltip for a link"
84
86
85
87
```
86
88
@@ -89,4 +91,4 @@ flowchart LR
89
91
3.**Deploy**: Delivering software to customers or systems.
90
92
4.**Monitor**: Observing software in production to detect issues.
91
93
92
-
Traditionally, cybersecurity focused on "Source" and "Monitor." However, incidents like Log4Shell have demonstrated the need to secure the entire chain—especially build and deployment processes.
94
+
Traditionally, the world has focused on "Source" and "Monitor." However, incidents like Log4Shell have demonstrated the need to secure the entire chain—especially build and deployment processes.
In the context of software, **provenance** refers to the origin or source of the code. It aims to answer questions like, _Where did this code or system come from? Who wrote it? Who built it? Has it been changed over time? Who verified it?_
8
+
9
+
These kind of questions are tantamount to risk management and ensuring the integrity of our systems, because when you know exactly where a particular piece of software comes from, you are in a much greater position to identify trusted sources and potential risks.
10
+
11
+
Provenance is an important factor in software supply chain security, and a key element of [compliance](/category/compliance), where regulations (e.g. GDPR, HIPAA) may require organizations to track and document software origins to ensure proper data handling and security.
12
+
13
+
## How does provenance work?
14
+
15
+
We can incorporate provenance into our software delivery lifecycle using a variety of approaches, but the most common being a version control system, or VCS, like git or Mercurial. A VCS tracks changes in code and show who made what changes and when.
16
+
17
+
**Digital signatures** are becoming increasingly relevant in this space, as they provide developers and organizations the ability to sign software releases to prove authenticity (for example, using vendor agnostic tools like <ahref="https://sigstore.dev"rel="nofollow"target="_blank">Sigstore</a>).
18
+
19
+
[SBOMs](/what-is-an-sbom-software-bill-of-materials-and-why-does-it-matter) are detailed lists of all the components and dependencies in a software project, which can also aid in providing the transparency required for provenance.
20
+
21
+
In addition, there are specific provenance tracking tools available, with two of the most popular being [in-toto](https://in-toto.io/) and [SLSA](/slsa-supply-chain-levels-compliance-for-software).
0 commit comments