Snap CISO: I rate software supply chain risk 9.9 out of 10
(2023/03/04)
- Reference: 1677888068
- News link: https://www.theregister.co.uk/2023/03/04/snap_ciso_supply_chain_security/
- Source link:
SCSW On a scale of 1 to 10, 10 being the highest risk, Snap Chief Information Security Officer Jim Higgins rates software supply chain risk "about 9.9"
Ten, for the record, is "always security hygiene," he told The Register . It seems we're a long way from avoiding the next SolarWinds-style scenario.
Not only is the supply chain at high risk, but it's a tough security problem to fix because a single product can have tens of thousands of software dependencies.
"It's a physics problem," Higgins said, in that software packages are dependent on so many other third-party and open-source software libraries. And it only takes a bug in one of these to make your organization the next cautionary tale.
The most important thing his fellow CISOs can do to improve supply chain security is to know what software their organization uses and understand the dependencies across the supply chain, according to Higgins. He recommends adding a full inventory of libraries in use as a start point for fixing the problem, so security staff know exactly what to check.
[1]Warning on SolarWinds-like supply-chain attacks: 'They're just getting bigger'
[2]Pushers of insecure software in Biden's crosshairs
[3]Feeling VEXed by software supply chain security? You're not alone
[4]US cybersecurity chief: Software makers shouldn't lawyer their way out of security responsibilities
"Understanding your inventory is absolutely No. 1," he said. "It's 50 percent of the problem. If you can understand where everything is and a CVE hits, then at least you know immediately what you need to do and where."
Oh, and also, don't forget to patch. ®
[5]
Get our [6]Tech Resources
[1] https://www.theregister.com/2023/03/03/solarwinds_supplychain_security/
[2] https://www.theregister.com/2023/03/03/us_national_cybersecurity_strategy/
[3] https://www.theregister.com/2023/02/28/supply_chain_security_chainguard/
[4] https://www.theregister.com/2023/02/28/cisa_easterly_secure_software/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZALQdM6dACbAZ7ffUfteQgAAAM4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://whitepapers.theregister.com/
Ten, for the record, is "always security hygiene," he told The Register . It seems we're a long way from avoiding the next SolarWinds-style scenario.
Not only is the supply chain at high risk, but it's a tough security problem to fix because a single product can have tens of thousands of software dependencies.
"It's a physics problem," Higgins said, in that software packages are dependent on so many other third-party and open-source software libraries. And it only takes a bug in one of these to make your organization the next cautionary tale.
The most important thing his fellow CISOs can do to improve supply chain security is to know what software their organization uses and understand the dependencies across the supply chain, according to Higgins. He recommends adding a full inventory of libraries in use as a start point for fixing the problem, so security staff know exactly what to check.
[1]Warning on SolarWinds-like supply-chain attacks: 'They're just getting bigger'
[2]Pushers of insecure software in Biden's crosshairs
[3]Feeling VEXed by software supply chain security? You're not alone
[4]US cybersecurity chief: Software makers shouldn't lawyer their way out of security responsibilities
"Understanding your inventory is absolutely No. 1," he said. "It's 50 percent of the problem. If you can understand where everything is and a CVE hits, then at least you know immediately what you need to do and where."
Oh, and also, don't forget to patch. ®
[5]
Get our [6]Tech Resources
[1] https://www.theregister.com/2023/03/03/solarwinds_supplychain_security/
[2] https://www.theregister.com/2023/03/03/us_national_cybersecurity_strategy/
[3] https://www.theregister.com/2023/02/28/supply_chain_security_chainguard/
[4] https://www.theregister.com/2023/02/28/cisa_easterly_secure_software/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZALQdM6dACbAZ7ffUfteQgAAAM4&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[6] https://whitepapers.theregister.com/